From c812d97527d7274ee5dca08393fd02c20b6f1471 Mon Sep 17 00:00:00 2001
From: chenos <chenlinxh@gmail.com>
Date: Wed, 31 Mar 2021 00:01:30 +0800
Subject: [PATCH] fix: sub-table field permissions

---
 .../src/AccessController.ts                   | 11 +++++++++
 packages/plugin-permissions/src/server.ts     | 24 +++++++++++++++++++
 2 files changed, 35 insertions(+)

diff --git a/packages/plugin-permissions/src/AccessController.ts b/packages/plugin-permissions/src/AccessController.ts
index 381b9ef16..c35481fdb 100644
--- a/packages/plugin-permissions/src/AccessController.ts
+++ b/packages/plugin-permissions/src/AccessController.ts
@@ -212,6 +212,17 @@ export default class AccessController<T extends typeof AccessController = typeof
     return existed ? any : null;
   }
 
+  async getPermissions(): Promise<any> {
+    const [Collection, Permission] = this.context.db.getModels(['collections', 'permissions']);
+    const roles = await this.getRoles();
+    const permissions = await Permission.findAll({
+      where: {
+        role_id: roles.map(role => role.id),
+      }
+    });
+    return permissions;
+  }
+
   async getCollections(): Promise<any> {
     const [Collection, Permission] = this.context.db.getModels(['collections', 'permissions']);
     const isRoot = await this.isRoot();
diff --git a/packages/plugin-permissions/src/server.ts b/packages/plugin-permissions/src/server.ts
index 2e81d3008..7552b8687 100644
--- a/packages/plugin-permissions/src/server.ts
+++ b/packages/plugin-permissions/src/server.ts
@@ -109,6 +109,30 @@ export class Permissions {
 
     // 关系数据的权限
     if (associatedName && resourceField) {
+      if (resourceField.options.id && resourceField.options.interface === 'subTable') {
+        if (await ctx.ac.isRoot()) {
+          return next();
+        }
+        const permissions = await ctx.ac.getPermissions();
+        const FieldPermission = ctx.db.getModel('fields_permissions');
+        const fps = await FieldPermission.findAll({
+          where: {
+            field_id: resourceField.options.id,
+            permission_id: {
+              [Op.in]: permissions.map(p => p.id),
+            }
+          },
+        });
+        if (fps.length) {
+          for (const fp of fps) {
+            console.log('fp.actions', fp.actions);
+            if (Array.isArray(fp.actions) && fp.actions.includes(`${resourceField.options.collection_name}:${actionName}`)) {
+              return next();
+            }
+          }
+          return this.reject(ctx);
+        }
+      }
       result = await ctx.ac.can(resourceField.options.target).act(actionName).any();
     } else {
       result = await ctx.ac.can(resourceName).act(actionName).any();