wabe 0.6.12 → 0.6.14

package/src/hooks/protected.test.ts

@@ -1,551 +0,0 @@
-import { describe, expect, it, beforeAll, afterAll } from 'bun:test'
-import {
-	createUserAndUpdateRole,
-	type DevWabeTypes,
-	getAnonymousClient,
-	getGraphqlClient,
-} from '../utils/helper'
-import { setupTests, closeTests } from '../utils/testHelper'
-import type { Wabe } from '../server'
-import { RoleEnum } from '../../generated/wabe'
-import { gql, type GraphQLClient } from 'graphql-request'
-
-describe('Protected hook', () => {
-	let wabe: Wabe<DevWabeTypes>
-	let anonymousClient: GraphQLClient
-	let rootClient: GraphQLClient
-
-	beforeAll(async () => {
-		const setup = await setupTests([
-			{
-				name: 'Test',
-				fields: {
-					name: {
-						type: 'String',
-						protected: {
-							authorizedRoles: [RoleEnum.Client],
-							protectedOperations: ['update', 'read'],
-						},
-					},
-					noOne: {
-						type: 'String',
-						protected: {
-							authorizedRoles: [],
-							protectedOperations: ['update', 'read'],
-						},
-					},
-					rootOnly: {
-						type: 'String',
-						protected: {
-							authorizedRoles: ['rootOnly'],
-							protectedOperations: ['update', 'read'],
-						},
-					},
-					notOperation: {
-						type: 'String',
-						protected: {
-							authorizedRoles: [RoleEnum.Client],
-							protectedOperations: ['update'],
-						},
-					},
-					notOperationUpdate: {
-						type: 'String',
-						protected: {
-							authorizedRoles: [RoleEnum.Client],
-							protectedOperations: ['read'],
-						},
-					},
-				},
-				permissions: {
-					read: {
-						authorizedRoles: ['everyone'],
-						requireAuthentication: true,
-					},
-					create: {
-						authorizedRoles: ['everyone'],
-						requireAuthentication: true,
-					},
-					update: {
-						authorizedRoles: ['everyone'],
-						requireAuthentication: true,
-					},
-				},
-			},
-		])
-		wabe = setup.wabe
-		anonymousClient = getAnonymousClient(setup.port)
-		rootClient = getGraphqlClient(setup.port)
-	})
-
-	afterAll(async () => {
-		await closeTests(wabe)
-	})
-
-	it('should not throw an error if the operation in not in the list of protected operations (read)', async () => {
-		const { userClient } = await createUserAndUpdateRole({
-			anonymousClient,
-			rootClient,
-			roleName: RoleEnum.Client,
-			port: wabe.config.port,
-		})
-
-		const { userClient: userClient2 } = await createUserAndUpdateRole({
-			anonymousClient,
-			rootClient,
-			roleName: RoleEnum.Admin,
-			port: wabe.config.port,
-		})
-
-		await userClient.request<any>(gql`
-			mutation createTest {
-				createTest(input: { fields: { name: "test" } }) {
-					test {
-						name
-					}
-				}
-			}
-		`)
-
-		expect(
-			userClient.request<any>(gql`
-				query tests {
-					tests {
-						edges {
-							node {
-								notOperation
-							}
-						}
-					}
-				}
-			`),
-		).resolves.toEqual(expect.anything())
-
-		expect(
-			userClient2.request<any>(gql`
-				query tests {
-					tests {
-						edges {
-							node {
-								notOperation
-							}
-						}
-					}
-				}
-			`),
-		).resolves.toEqual(expect.anything())
-	})
-
-	it('should not throw an error if the operation in not in the list of protected operations (update)', async () => {
-		const { userClient } = await createUserAndUpdateRole({
-			anonymousClient,
-			rootClient,
-			roleName: RoleEnum.Client,
-			port: wabe.config.port,
-		})
-
-		const { userClient: userClient2 } = await createUserAndUpdateRole({
-			anonymousClient,
-			rootClient,
-			roleName: RoleEnum.Admin,
-			port: wabe.config.port,
-		})
-
-		const res = await userClient.request<any>(gql`
-			mutation createTest {
-				createTest(input: { fields: { name: "test" } }) {
-					test {
-						id
-						name
-					}
-				}
-			}
-		`)
-
-		expect(
-			userClient.request<any>(gql`
-          mutation updateTest {
-              updateTest(input: {id: "${res.createTest.test.id}", fields: {notOperationUpdate: "test2"}}) {
-                  ok
-             }
-          }
-     `),
-		).resolves.toEqual(expect.anything())
-
-		expect(
-			userClient2.request<any>(gql`
-          mutation updateTest {
-              updateTest(input: {id: "${res.createTest.test.id}", fields: {notOperationUpdate: "test2"}}) {
-                  ok
-             }
-          }
-     `),
-		).resolves.toEqual(expect.anything())
-	})
-
-	it("should throw an error if the user doesn't have the right role on read", async () => {
-		const { userClient } = await createUserAndUpdateRole({
-			anonymousClient,
-			rootClient,
-			roleName: RoleEnum.Client,
-			port: wabe.config.port,
-		})
-
-		const { userClient: userClient2 } = await createUserAndUpdateRole({
-			anonymousClient,
-			rootClient,
-			roleName: RoleEnum.Admin,
-			port: wabe.config.port,
-		})
-
-		await userClient.request<any>(gql`
-			mutation createTest {
-				createTest(input: { fields: { name: "test" } }) {
-					test {
-						name
-					}
-				}
-			}
-		`)
-
-		expect(
-			userClient.request<any>(gql`
-				query tests {
-					tests {
-						edges {
-							node {
-								name
-							}
-						}
-					}
-				}
-			`),
-		).resolves.toEqual(expect.anything())
-
-		expect(
-			userClient2.request<any>(gql`
-				query tests {
-					tests {
-						edges {
-							node {
-								name
-							}
-						}
-					}
-				}
-			`),
-		).rejects.toThrowError('You are not authorized to read this field')
-	})
-
-	it("should throw an error if the user doesn't have the right role on update", async () => {
-		const { userClient } = await createUserAndUpdateRole({
-			anonymousClient,
-			rootClient,
-			roleName: RoleEnum.Client,
-			port: wabe.config.port,
-		})
-
-		const { userClient: userClient2 } = await createUserAndUpdateRole({
-			anonymousClient,
-			rootClient,
-			roleName: RoleEnum.Admin,
-			port: wabe.config.port,
-		})
-
-		const res = await userClient.request<any>(gql`
-			mutation createTest {
-				createTest(input: { fields: { name: "test" } }) {
-					test {
-						id
-						name
-					}
-				}
-			}
-		`)
-
-		await userClient.request<any>(gql`
-     mutation updateTest {
-         updateTest(input: {id: "${res.createTest.test.id}", fields: {name: "test2"}}) {
-             test {
-                 id
-             }
-         }
-     }
-     `)
-
-		expect(
-			userClient2.request<any>(gql`
-          mutation updateTest {
-              updateTest(input: {id: "${res.createTest.test.id}", fields: {name: "test2"}}) {
-                  test {
-                      name
-                  }
-              }
-          }
-     `),
-		).rejects.toThrowError('You are not authorized to update this field')
-	})
-
-	it('should throw an error no one have the right role on read', async () => {
-		const { userClient } = await createUserAndUpdateRole({
-			anonymousClient,
-			rootClient,
-			roleName: RoleEnum.Client,
-			port: wabe.config.port,
-		})
-
-		const { userClient: userClient2 } = await createUserAndUpdateRole({
-			anonymousClient,
-			rootClient,
-			roleName: RoleEnum.Admin,
-			port: wabe.config.port,
-		})
-
-		await userClient.request<any>(gql`
-			mutation createTest {
-				createTest(input: { fields: { noOne: "test" } }) {
-					test {
-						id
-						name
-					}
-				}
-			}
-		`)
-
-		expect(
-			rootClient.request<any>(gql`
-				query tests {
-					tests {
-						edges {
-							node {
-								noOne
-							}
-						}
-					}
-				}
-			`),
-		).rejects.toThrowError('You are not authorized to read this field')
-
-		expect(
-			userClient.request<any>(gql`
-				query tests {
-					tests {
-						edges {
-							node {
-								noOne
-							}
-						}
-					}
-				}
-			`),
-		).rejects.toThrowError('You are not authorized to read this field')
-
-		expect(
-			userClient2.request<any>(gql`
-				query tests {
-					tests {
-						edges {
-							node {
-								noOne
-							}
-						}
-					}
-				}
-			`),
-		).rejects.toThrowError('You are not authorized to read this field')
-	})
-
-	it('should throw an error no one have the right role on update', async () => {
-		const { userClient } = await createUserAndUpdateRole({
-			anonymousClient,
-			rootClient,
-			roleName: RoleEnum.Client,
-			port: wabe.config.port,
-		})
-
-		const { userClient: userClient2 } = await createUserAndUpdateRole({
-			anonymousClient,
-			rootClient,
-			roleName: RoleEnum.Admin,
-			port: wabe.config.port,
-		})
-
-		const res = await userClient.request<any>(gql`
-			mutation createTest {
-				createTest(input: { fields: { noOne: "test" } }) {
-					test {
-						id
-						name
-					}
-				}
-			}
-		`)
-
-		expect(
-			rootClient.request<any>(gql`
-     mutation updateTest {
-         updateTest(input: {id: "${res.createTest.test.id}", fields: {noOne: "test2"}}) {
-             test {
-                 id
-             }
-         }
-     }
-     `),
-		).rejects.toThrowError('You are not authorized to update this field')
-
-		expect(
-			userClient.request<any>(gql`
-     mutation updateTest {
-         updateTest(input: {id: "${res.createTest.test.id}", fields: {noOne: "test2"}}) {
-             test {
-                 id
-             }
-         }
-     }
-     `),
-		).rejects.toThrowError('You are not authorized to update this field')
-
-		expect(
-			userClient2.request<any>(gql`
-          mutation updateTest {
-              updateTest(input: {id: "${res.createTest.test.id}", fields: {name: "test2"}}) {
-                  test {
-                      name
-                  }
-              }
-          }
-     `),
-		).rejects.toThrowError('You are not authorized to update this field')
-	})
-
-	it('should allow only root to read a field protected by rootOnly', async () => {
-		const { userClient } = await createUserAndUpdateRole({
-			anonymousClient,
-			rootClient,
-			roleName: RoleEnum.Client,
-			port: wabe.config.port,
-		})
-
-		const { userClient: userClient2 } = await createUserAndUpdateRole({
-			anonymousClient,
-			rootClient,
-			roleName: RoleEnum.Admin,
-			port: wabe.config.port,
-		})
-
-		await rootClient.request<any>(gql`
-			mutation createTest {
-				createTest(input: { fields: { name: "test" } }) {
-					test {
-						id
-					}
-				}
-			}
-		`)
-
-		expect(
-			rootClient.request<any>(gql`
-				query tests {
-					tests {
-						edges {
-							node {
-								rootOnly
-							}
-						}
-					}
-				}
-			`),
-		).resolves.toEqual(expect.anything())
-
-		expect(
-			userClient.request<any>(gql`
-				query tests {
-					tests {
-						edges {
-							node {
-								rootOnly
-							}
-						}
-					}
-				}
-			`),
-		).rejects.toThrow('You are not authorized to read this field')
-
-		expect(
-			userClient2.request<any>(gql`
-				query tests {
-					tests {
-						edges {
-							node {
-								rootOnly
-							}
-						}
-					}
-				}
-			`),
-		).rejects.toThrowError('You are not authorized to read this field')
-	})
-
-	it('should allow only root to update a field protected by rootOnly', async () => {
-		const { userClient } = await createUserAndUpdateRole({
-			anonymousClient,
-			rootClient,
-			roleName: RoleEnum.Client,
-			port: wabe.config.port,
-		})
-
-		const { userClient: userClient2 } = await createUserAndUpdateRole({
-			anonymousClient,
-			rootClient,
-			roleName: RoleEnum.Admin,
-			port: wabe.config.port,
-		})
-
-		const res = await rootClient.request<any>(gql`
-			mutation createTest {
-				createTest(input: { fields: { name: "test" } }) {
-					test {
-						id
-					}
-				}
-			}
-		`)
-
-		// Root client should be able to update
-		expect(
-			rootClient.request<any>(gql`
-        mutation updateTest {
-            updateTest(input: {id: "${res.createTest.test.id}", fields: {rootOnly: "updatedTest"}}) {
-                test {
-                    rootOnly
-                }
-            }
-        }
-      `),
-		).resolves.toEqual(expect.anything())
-
-		// User clients should not be able to update
-		expect(
-			userClient.request<any>(gql`
-        mutation updateTest {
-            updateTest(input: {id: "${res.createTest.test.id}", fields: {rootOnly: "updatedTest"}}) {
-                test {
-                    rootOnly
-                }
-            }
-        }
-      `),
-		).rejects.toThrowError('You are not authorized to update this field')
-
-		expect(
-			userClient2.request<any>(gql`
-        mutation updateTest {
-            updateTest(input: {id: "${res.createTest.test.id}", fields: {rootOnly: "updatedTest"}}) {
-                test {
-                    rootOnly
-                }
-            }
-        }
-      `),
-		).rejects.toThrowError('You are not authorized to update this field')
-	})
-})

package/src/hooks/protected.ts

@@ -1,74 +0,0 @@
-import { OperationType } from '.'
-import type { DevWabeTypes } from '../utils/helper'
-import type { HookObject } from './HookObject'
-import type { SchemaClassWithProtectedFields } from '../schema/Schema'
-import type { WabeContext } from '../server/interface'
-
-const _checkProtected = (
-	hookObject: HookObject<DevWabeTypes, any>,
-	operationType: OperationType,
-) => {
-	const schemaClass = hookObject.context.wabe.config.schema?.classes?.find(
-		(currentClass) => currentClass.name === hookObject.className,
-	)
-
-	if (!schemaClass) return
-
-	const userRole = hookObject.getUser()?.role?.name || ''
-	const isRoot = hookObject.context.isRoot
-
-	if (operationType === OperationType.BeforeRead) {
-		Object.keys(hookObject.select).forEach((fieldName) => {
-			const protectedForCurrentField = schemaClass.fields[fieldName]?.protected
-
-			if (!protectedForCurrentField) return
-
-			if (protectedForCurrentField?.protectedOperations.includes('read')) {
-				if (isRoot && protectedForCurrentField.authorizedRoles.includes('rootOnly')) return
-
-				// @ts-expect-error
-				if (!protectedForCurrentField.authorizedRoles.includes(userRole))
-					throw new Error('You are not authorized to read this field')
-			}
-		})
-
-		return
-	}
-
-	const fieldsUpdated = hookObject.getNewData()
-
-	const operation = operationType === OperationType.BeforeUpdate ? 'update' : 'create'
-
-	Object.keys(fieldsUpdated).forEach((fieldName) => {
-		const protectedForCurrentField = schemaClass.fields[fieldName]?.protected
-
-		if (protectedForCurrentField?.protectedOperations.includes(operation)) {
-			if (isRoot && protectedForCurrentField.authorizedRoles.includes('rootOnly')) return
-
-			// @ts-expect-error
-			if (!protectedForCurrentField.authorizedRoles.includes(userRole))
-				throw new Error(`You are not authorized to ${operation} this field`)
-		}
-	})
-}
-
-export const canUserReadField = (
-	schemaClass: SchemaClassWithProtectedFields,
-	fieldName: string,
-	context: Pick<WabeContext<any>, 'isRoot' | 'user'>,
-): boolean => {
-	const protectedForField = schemaClass.fields[fieldName]?.protected
-	if (!protectedForField || !protectedForField.protectedOperations.includes('read')) return true
-	if (context.isRoot && protectedForField.authorizedRoles.includes('rootOnly')) return true
-	const userRole = context.user?.role?.name || ''
-	return protectedForField.authorizedRoles.includes(userRole)
-}
-
-export const defaultCheckProtectedOnBeforeRead = (object: HookObject<DevWabeTypes, any>) =>
-	_checkProtected(object, OperationType.BeforeRead)
-
-export const defaultCheckProtectedOnBeforeUpdate = (object: HookObject<DevWabeTypes, any>) =>
-	_checkProtected(object, OperationType.BeforeUpdate)
-
-export const defaultCheckProtectedOnBeforeCreate = (object: HookObject<DevWabeTypes, any>) =>
-	_checkProtected(object, OperationType.BeforeCreate)