* feat: getRepository * getRepository return type * export action * add: acl * feat: setResourceAction * feat: action alias * chore: code struct * feat: removeResourceAction * chore: file name * ignorecase * remove ACL * feat: ACL * feat: role toJSON * using emit * chore: test * feat: plugin-acl * feat: acl with predicate * grant universal action test * grant action test * update resource action test * revoke resource action * usingActionsConfig switch * plugin-ui-schema-storage * remove global acl instance * fix: collection manager with sqlite * add own action listener * add acl middleware * add acl allowConfigure strategy option * add plugin-acl allowConfigure * change acl resourceName * add acl middleware merge params * bugfix * append fields on acl action params * acl middleware parse template * fix: collection-manager migrate * add acl association field test * feat(plugin-acl): grant association field actions * chore(plugin-acl): type name * feat(plugin-acl): regrant actions on resource action update * feat(plugin-acl): regrant action on field destroy * fix(plugin-acl): test * fix(plugin-acl): test run * feat(plugin-acl): set default role * feat(plugin-users): set user default role * test(plugin-users): create user with role * feat(plugin-users): create user with role Co-authored-by: chenos <chenlinxh@gmail.com>
61 lines
1.8 KiB
TypeScript
61 lines
1.8 KiB
TypeScript
import { Database, Model } from '@nocobase/database';
|
|
import { ACL, ACLRole } from '@nocobase/acl';
|
|
import { RoleResourceActionModel } from './RoleResourceActionModel';
|
|
import { AssociationFieldsActions, GrantHelper } from '../server';
|
|
|
|
export class RoleResourceModel extends Model {
|
|
async revoke(options: { role: ACLRole; resourceName: string; grantHelper: GrantHelper }) {
|
|
const { role, resourceName, grantHelper } = options;
|
|
role.revokeResource(resourceName);
|
|
|
|
const targetActions = grantHelper.resourceTargetActionMap.get(resourceName) || [];
|
|
|
|
for (const targetAction of targetActions) {
|
|
const targetActionResource = (grantHelper.targetActionResourceMap.get(targetAction) || []).filter(
|
|
(item) => resourceName !== item,
|
|
);
|
|
|
|
grantHelper.targetActionResourceMap.set(targetAction, targetActionResource);
|
|
if (targetActionResource.length == 0) {
|
|
role.revokeAction(targetAction);
|
|
}
|
|
}
|
|
|
|
grantHelper.resourceTargetActionMap.set(resourceName, []);
|
|
}
|
|
|
|
async writeToACL(options: {
|
|
acl: ACL;
|
|
associationFieldsActions: AssociationFieldsActions;
|
|
grantHelper: GrantHelper;
|
|
transaction: any;
|
|
}) {
|
|
const { acl, associationFieldsActions, grantHelper } = options;
|
|
const resourceName = this.get('name') as string;
|
|
const roleName = this.get('roleName') as string;
|
|
const role = acl.getRole(roleName);
|
|
|
|
await this.revoke({ role, resourceName, grantHelper });
|
|
|
|
// @ts-ignore
|
|
if (this.usingActionsConfig === false) {
|
|
return;
|
|
}
|
|
|
|
// @ts-ignore
|
|
const actions: RoleResourceActionModel[] = await this.getActions({
|
|
transaction: options.transaction,
|
|
});
|
|
|
|
for (const action of actions) {
|
|
await action.writeToACL({
|
|
acl,
|
|
role,
|
|
resourceName,
|
|
associationFieldsActions,
|
|
grantHelper: options.grantHelper,
|
|
});
|
|
}
|
|
}
|
|
}
|