Fix acl error (#358)

* fix: empty resource acl error

* fix: removeAction error
This commit is contained in:
ChengLei Shao 2022-05-04 20:44:59 +08:00 committed by GitHub
parent 46e660b10d
commit 0b7f96dab3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 13 additions and 5 deletions

View File

@ -51,6 +51,7 @@ export class RoleResourceActionModel extends Model {
const fieldTarget = collectionField.get('target'); const fieldTarget = collectionField.get('target');
if (fieldActions) { if (fieldActions) {
// grant association actions to role
const associationActions = fieldActions.associationActions || []; const associationActions = fieldActions.associationActions || [];
associationActions.forEach((associationAction) => { associationActions.forEach((associationAction) => {
const actionName = `${resourceName}.${fieldTarget}:${associationAction}`; const actionName = `${resourceName}.${fieldTarget}:${associationAction}`;
@ -62,14 +63,15 @@ export class RoleResourceActionModel extends Model {
targetActions.forEach((targetAction) => { targetActions.forEach((targetAction) => {
const targetActionPath = `${fieldTarget}:${targetAction}`; const targetActionPath = `${fieldTarget}:${targetAction}`;
grantHelper.resourceTargetActionMap.set(resourceName, [ // set resource target action with current resourceName
grantHelper.resourceTargetActionMap.set(`${role.name}.${resourceName}`, [
...(grantHelper.resourceTargetActionMap.get(resourceName) || []), ...(grantHelper.resourceTargetActionMap.get(resourceName) || []),
targetActionPath, targetActionPath,
]); ]);
grantHelper.targetActionResourceMap.set(targetActionPath, [ grantHelper.targetActionResourceMap.set(targetActionPath, [
...(grantHelper.targetActionResourceMap.get(targetActionPath) || []), ...(grantHelper.targetActionResourceMap.get(targetActionPath) || []),
resourceName, `${role.name}.${resourceName}`,
]); ]);
role.grantAction(targetActionPath); role.grantAction(targetActionPath);

View File

@ -8,20 +8,21 @@ export class RoleResourceModel extends Model {
const { role, resourceName, grantHelper } = options; const { role, resourceName, grantHelper } = options;
role.revokeResource(resourceName); role.revokeResource(resourceName);
const targetActions = grantHelper.resourceTargetActionMap.get(resourceName) || []; const targetActions = grantHelper.resourceTargetActionMap.get(`${role.name}.${resourceName}`) || [];
for (const targetAction of targetActions) { for (const targetAction of targetActions) {
const targetActionResource = (grantHelper.targetActionResourceMap.get(targetAction) || []).filter( const targetActionResource = (grantHelper.targetActionResourceMap.get(targetAction) || []).filter(
(item) => resourceName !== item, (item) => `${role.name}.${resourceName}` !== item,
); );
grantHelper.targetActionResourceMap.set(targetAction, targetActionResource); grantHelper.targetActionResourceMap.set(targetAction, targetActionResource);
if (targetActionResource.length == 0) { if (targetActionResource.length == 0) {
role.revokeAction(targetAction); role.revokeAction(targetAction);
} }
} }
grantHelper.resourceTargetActionMap.set(resourceName, []); grantHelper.resourceTargetActionMap.set(`${role.name}.${resourceName}`, []);
} }
async writeToACL(options: { async writeToACL(options: {

View File

@ -30,6 +30,8 @@ export class GrantHelper {
} }
export class PluginACL extends Plugin { export class PluginACL extends Plugin {
// association field actions config
associationFieldsActions: AssociationFieldsActions = {}; associationFieldsActions: AssociationFieldsActions = {};
grantHelper = new GrantHelper(); grantHelper = new GrantHelper();
@ -43,6 +45,8 @@ export class PluginACL extends Plugin {
} }
registerAssociationFieldsActions() { registerAssociationFieldsActions() {
// if grant create action to role, it should
// also grant add action and association target's view action
this.registerAssociationFieldAction('linkTo', { this.registerAssociationFieldAction('linkTo', {
view: { view: {
associationActions: ['list', 'get'], associationActions: ['list', 'get'],
@ -107,6 +111,7 @@ export class PluginACL extends Plugin {
const roles = (await this.app.db.getRepository('roles').find({ const roles = (await this.app.db.getRepository('roles').find({
appends: ['resources', 'resources.actions'], appends: ['resources', 'resources.actions'],
})) as RoleModel[]; })) as RoleModel[];
for (const role of roles) { for (const role of roles) {
role.writeToAcl({ acl: this.acl }); role.writeToAcl({ acl: this.acl });
for (const resource of role.get('resources') as RoleResourceModel[]) { for (const resource of role.get('resources') as RoleResourceModel[]) {