* fix: sort field with table dose not have primary key * feat: fixed params merger * chore(plugins/acl): fixed params * chore(plugins/acl): allowConfigure of collections * chore(plugins/china-region): disable actions other than list * chore(plugins/collection-manager): allowConfigure permission * chore(plugins/file-manager): acl fixed params * chore: acl fixed params * chore: rolesResourcesScopes onDelete cascade * fix: install error * chore: test * fix: root user fixed params * fix: role resource scope onDelete * chore: test * chore: test * fix: acl * chore: disable index.html cache * chore: disable index.html cache * test: destory user role * test: destory throught table * fix: test * fix: test * chore: add rolesUsers to fixed params * feat: permission logging * feat: permission logging * fix: test * fix: test * chore: disable grant target action * fix: appends with fields * fix: get action params * fix: associationActions * chore: change AssociationField using relation type * chore: typo * refactor: allow to skip * fix: prettier * chore: attachments association action * fix: allowConfigure condition * fix: deprecated allow * fix: please use skip instead * feat: table column aclcheck * chore: test * feat: throw error when detory no permission record * chore: test * chore: acl test * feat: field acl * chore: after action middleware * fix: destory permission check * chore: middleware use * fix: test * feat: filter match * feat: subform/subtable field acl check * feat: action permision by scope * feat: action permision by scope * feat: list action with allowedActions * chore: all allowed action * fix: pk error * fix: merge error * fix: create query sql * fix: skip permission * fix: scope with association field * feat: action acl fix * feat: action acl fix * fix: update submodule * Feat: setting center permission (#1214) * feat: add setting center permissions * feat: setting center permissions backlist * feat: setting center permissions BLACKLIST * feat: setting center permissions blacklist * feat: setting center permissions blacklist * feat: setting center permission * feat: configure plugin tab expand Co-authored-by: chenos <chenlinxh@gmail.com> * Feat :field acl (#1211) Co-authored-by: chenos <chenlinxh@gmail.com> * fix: build error * test: acl snippet * feat: set field * fix: test * fix: build error * fix: utils Dependency cycles * feat: general permissions * feat: delete pluginTabBlacklist * fix: test * feat: snippetManager allow method * feat: acl role snippetAllowed method * feat: array field repository * feat: ArrayFieldRepository * fix: test * fix: ci * fix: ci error * fix: add set parse * test: array field repository * chore: addSnippetPatten * fix: start * feat: sync role snippets * feat: snippets check * feat: snippets check * chore: acl role snippet api * fix: test * fix: test * refactor: acl role snippets * chore: registerACLSettingSnippet * chore: default snippets * feat: snippets match * feat: snippets check * feat: snippets check * feat: pm permision check * feat: pm permision check * feat: snippet pattern match * feat: pluginManagerToolbar check * feat: pluginManagerToolbar check * chore: snippets default value * feat: set role snippets migration * chore: snippets * feat: acl local * feat: acl local * feat: bookmask fix * feat: plugin-manger & ui-editor snippet * feat: set allowConfigure to false when upgrade to snippets * feat: destory action acl fix * feat: destory action acl fix * fix: association resource params merge * fix: ui editor snippet * feat: action acl fix * chore: move list meta middleware into plugins/acl * fix: test * feat: action acl fix * feat: action acl check fix * feat: plugins toolbar fix * feat: gitmodules * fix: subproject * chore: add avaiableActions to snippet * chore: change plugin-manager snippet * feat: configure action acl fix * feat: plugin tab acl check fix * chore: roles snippets * fix: add actions to snippet * feat: allowconfigure fix * fix: count with filterBy * fix: build error * feat: get action with allowedActions * feat: acl route check fix * feat: aclActionProvider fix * feat: actionscpe fix * feat: actionname alias * feat: setting center fix * feat: acl provider fix * fix: role collection * feat: associate resource acl * feat: associate resource acl * feat: redirect to 403 * feat: route redirct * feat: acl scope check by record * fix: fields appends fix * fix: fields appends fix * fix: fields appends fix * fix: allowedActions fix * fix: menu items * fix: rename * fix: improve code * fix: improve code * fix: improve code * fix: ctx?.data?.data * fix: styling * fix: allowAll after ignore scope * chore: allowConfigure condition * fix: collections.fields:* * fix: acl test * fix: update submodule * fix: acl test * fix: acl snippet * fix: updates * fix: only load history for logged-in users * fix: this.app.acl.registerSnippet * fix: downloadXlsxTemplate * fix: 404 * feat: allowedAction in association list response * fix: listData get * fix: test * fix: x-collection-field * fix: update record error * fix: calendar template * test: allow manager * fix: fetch action step * fix: update submodule * fix: refresh * fix: refresh * fix: rolesResourcesScopes * test: snippets * fix: snippets * fix: test * fix: omit filter.createdById * fix: improve code * fix: collections path * fix: test error * fix: upgrade error * fix: errors * fix: read allowed actions error * fix: kanban error * fix: error Co-authored-by: chenos <chenlinxh@gmail.com> Co-authored-by: katherinehhh <katherine_15995@163.com>
431 lines
8.9 KiB
TypeScript
431 lines
8.9 KiB
TypeScript
import { ACL } from '@nocobase/acl';
|
|
import { Database, HasManyRepository } from '@nocobase/database';
|
|
import UsersPlugin from '@nocobase/plugin-users';
|
|
import { MockServer } from '@nocobase/test';
|
|
import { prepareApp } from './prepare';
|
|
|
|
describe('association test', () => {
|
|
let app: MockServer;
|
|
let db: Database;
|
|
let acl: ACL;
|
|
|
|
let user;
|
|
let userAgent;
|
|
let admin;
|
|
let adminAgent;
|
|
|
|
afterEach(async () => {
|
|
await app.destroy();
|
|
});
|
|
|
|
beforeEach(async () => {
|
|
app = await prepareApp();
|
|
db = app.db;
|
|
acl = app.acl;
|
|
});
|
|
|
|
it('should set association actions', async () => {
|
|
await db.getRepository('collections').create({
|
|
values: {
|
|
name: 'posts',
|
|
fields: [
|
|
{ name: 'title', type: 'string' },
|
|
{ name: 'userComments', type: 'hasMany', target: 'comments', interface: 'linkTo' },
|
|
],
|
|
},
|
|
context: {},
|
|
});
|
|
|
|
await db.getRepository('collections').create({
|
|
values: {
|
|
name: 'comments',
|
|
fields: [{ name: 'content', type: 'string' }],
|
|
},
|
|
context: {},
|
|
});
|
|
|
|
await db.getRepository('roles').create({
|
|
values: {
|
|
name: 'test-role',
|
|
},
|
|
context: {},
|
|
});
|
|
|
|
await db.getRepository('roles.resources', 'test-role').create({
|
|
values: {
|
|
name: 'posts',
|
|
usingActionsConfig: true,
|
|
actions: [
|
|
{
|
|
name: 'view',
|
|
fields: ['userComments'],
|
|
},
|
|
],
|
|
},
|
|
context: {},
|
|
});
|
|
|
|
const role = acl.getRole('test-role');
|
|
|
|
expect(
|
|
acl.can({
|
|
role: 'test-role',
|
|
action: 'list',
|
|
resource: 'posts.userComments',
|
|
}),
|
|
).not.toBeNull();
|
|
|
|
const post = await db.getRepository('posts').create({
|
|
values: {
|
|
title: 'hello world',
|
|
userComments: [{ content: 'comment 1' }],
|
|
},
|
|
});
|
|
|
|
const UserRepo = db.getCollection('users').repository;
|
|
const user = await UserRepo.create({
|
|
values: {
|
|
roles: ['test-role'],
|
|
},
|
|
});
|
|
|
|
const userPlugin = app.getPlugin('users') as UsersPlugin;
|
|
|
|
const userAgent = app.agent().auth(
|
|
userPlugin.jwtService.sign({
|
|
userId: user.get('id'),
|
|
}),
|
|
{ type: 'bearer' },
|
|
);
|
|
|
|
//@ts-ignore
|
|
const response = await userAgent.resource('posts').list({});
|
|
expect(response.statusCode).toEqual(200);
|
|
const post1 = response.body.data[0];
|
|
expect(post1.userComments).not.toBeDefined();
|
|
});
|
|
});
|
|
|
|
describe('association field acl', () => {
|
|
let app: MockServer;
|
|
let db: Database;
|
|
let acl: ACL;
|
|
|
|
let user;
|
|
let userAgent;
|
|
let admin;
|
|
let adminAgent;
|
|
|
|
afterEach(async () => {
|
|
await app.destroy();
|
|
});
|
|
|
|
beforeEach(async () => {
|
|
app = await prepareApp();
|
|
db = app.db;
|
|
acl = app.acl;
|
|
|
|
await db.getRepository('roles').create({
|
|
values: {
|
|
name: 'new',
|
|
},
|
|
});
|
|
|
|
await db.getRepository('roles').create({
|
|
values: {
|
|
name: 'testAdmin',
|
|
snippets: ['pm.*'],
|
|
},
|
|
});
|
|
|
|
const UserRepo = db.getCollection('users').repository;
|
|
|
|
user = await UserRepo.create({
|
|
values: {
|
|
roles: ['new'],
|
|
},
|
|
});
|
|
|
|
admin = await UserRepo.create({
|
|
values: {
|
|
roles: ['testAdmin'],
|
|
},
|
|
});
|
|
|
|
const userPlugin = app.getPlugin('users') as UsersPlugin;
|
|
userAgent = app.agent().auth(
|
|
userPlugin.jwtService.sign({
|
|
userId: user.get('id'),
|
|
}),
|
|
{ type: 'bearer' },
|
|
);
|
|
|
|
adminAgent = app.agent().auth(
|
|
userPlugin.jwtService.sign({
|
|
userId: admin.get('id'),
|
|
}),
|
|
{ type: 'bearer' },
|
|
);
|
|
|
|
await db.getRepository('collections').create({
|
|
values: {
|
|
name: 'orders',
|
|
},
|
|
context: {},
|
|
});
|
|
|
|
await db.getRepository('collections.fields', 'users').create({
|
|
values: {
|
|
name: 'name',
|
|
type: 'string',
|
|
},
|
|
context: {},
|
|
});
|
|
|
|
await db.getRepository('collections.fields', 'users').create({
|
|
values: {
|
|
name: 'age',
|
|
type: 'integer',
|
|
},
|
|
context: {},
|
|
});
|
|
|
|
await db.getRepository('collections.fields', 'users').create({
|
|
values: {
|
|
interface: 'linkTo',
|
|
name: 'orders',
|
|
type: 'hasMany',
|
|
target: 'orders',
|
|
},
|
|
context: {},
|
|
});
|
|
|
|
await db.getRepository('collections.fields', 'orders').create({
|
|
values: {
|
|
name: 'content',
|
|
type: 'string',
|
|
},
|
|
context: {},
|
|
});
|
|
|
|
await adminAgent.resource('roles.resources', 'new').create({
|
|
values: {
|
|
name: 'users',
|
|
usingActionsConfig: true,
|
|
actions: [
|
|
{
|
|
name: 'create',
|
|
fields: ['orders'],
|
|
},
|
|
{
|
|
name: 'view',
|
|
fields: ['orders'],
|
|
},
|
|
],
|
|
},
|
|
});
|
|
|
|
await adminAgent.resource('roles.resources', 'new').create({
|
|
values: {
|
|
name: 'orders',
|
|
usingActionsConfig: true,
|
|
actions: [
|
|
{
|
|
name: 'view',
|
|
},
|
|
],
|
|
},
|
|
});
|
|
});
|
|
|
|
// skip because of disable grant associations target action
|
|
it.skip('should revoke target action on association action revoke', async () => {
|
|
expect(
|
|
acl.can({
|
|
role: 'new',
|
|
resource: 'orders',
|
|
action: 'list',
|
|
}),
|
|
).toMatchObject({
|
|
role: 'new',
|
|
resource: 'orders',
|
|
action: 'list',
|
|
});
|
|
|
|
await adminAgent.resource('roles.resources', 'new').update({
|
|
values: {
|
|
name: 'users',
|
|
usingActionsConfig: true,
|
|
actions: [],
|
|
},
|
|
});
|
|
|
|
expect(
|
|
acl.can({
|
|
role: 'new',
|
|
resource: 'orders',
|
|
action: 'list',
|
|
}),
|
|
).toBeNull();
|
|
});
|
|
|
|
it('should revoke association action on action revoke', async () => {
|
|
expect(
|
|
acl.can({
|
|
role: 'new',
|
|
resource: 'users.orders',
|
|
action: 'add',
|
|
}),
|
|
).toMatchObject({
|
|
role: 'new',
|
|
resource: 'users.orders',
|
|
action: 'add',
|
|
});
|
|
|
|
const viewAction = await db.getRepository('rolesResourcesActions').findOne({
|
|
filter: {
|
|
name: 'view',
|
|
},
|
|
});
|
|
|
|
const actionId = viewAction.get('id') as number;
|
|
|
|
const response = await adminAgent.resource('roles.resources', 'new').update({
|
|
filterByTk: 'users',
|
|
values: {
|
|
name: 'users',
|
|
usingActionsConfig: true,
|
|
actions: [
|
|
{
|
|
id: actionId,
|
|
},
|
|
],
|
|
},
|
|
});
|
|
|
|
expect(response.statusCode).toEqual(200);
|
|
|
|
expect(
|
|
acl.can({
|
|
role: 'new',
|
|
resource: 'users.orders',
|
|
action: 'add',
|
|
}),
|
|
).toBeNull();
|
|
});
|
|
|
|
it('should revoke association action on field deleted', async () => {
|
|
await adminAgent.resource('roles.resources', 'new').update({
|
|
filterByTk: 'users',
|
|
values: {
|
|
name: 'users',
|
|
usingActionsConfig: true,
|
|
actions: [
|
|
{
|
|
name: 'create',
|
|
fields: ['name', 'age'],
|
|
},
|
|
],
|
|
},
|
|
});
|
|
|
|
expect(
|
|
acl.can({
|
|
role: 'new',
|
|
resource: 'users',
|
|
action: 'create',
|
|
}),
|
|
).toMatchObject({
|
|
role: 'new',
|
|
resource: 'users',
|
|
action: 'create',
|
|
params: {
|
|
whitelist: ['age', 'name'],
|
|
},
|
|
});
|
|
|
|
const roleResource = await db.getRepository('rolesResources').findOne({
|
|
filter: {
|
|
name: 'users',
|
|
},
|
|
});
|
|
|
|
const action = await db
|
|
.getRepository<HasManyRepository>('rolesResources.actions', roleResource.get('id') as string)
|
|
.findOne({
|
|
filter: {
|
|
name: 'create',
|
|
},
|
|
});
|
|
|
|
expect(action.get('fields').includes('name')).toBeTruthy();
|
|
|
|
// remove field
|
|
await db.getRepository<HasManyRepository>('collections.fields', 'users').destroy({
|
|
filter: {
|
|
name: 'name',
|
|
},
|
|
context: {},
|
|
});
|
|
|
|
expect(
|
|
acl.can({
|
|
role: 'new',
|
|
resource: 'users',
|
|
action: 'create',
|
|
}),
|
|
).toMatchObject({
|
|
role: 'new',
|
|
resource: 'users',
|
|
action: 'create',
|
|
params: {
|
|
whitelist: ['age'],
|
|
},
|
|
});
|
|
});
|
|
|
|
it('should allow association fields access', async () => {
|
|
const createResponse = await userAgent.resource('users').create({
|
|
values: {
|
|
orders: [
|
|
{
|
|
content: 'apple',
|
|
},
|
|
],
|
|
},
|
|
});
|
|
|
|
expect(createResponse.statusCode).toEqual(200);
|
|
|
|
const user = await db.getRepository('users').findOne({
|
|
filterByTk: createResponse.body.data.id,
|
|
});
|
|
// @ts-ignore
|
|
expect(await user.countOrders()).toEqual(1);
|
|
|
|
expect(
|
|
acl.can({
|
|
role: 'new',
|
|
resource: 'users.orders',
|
|
action: 'list',
|
|
}),
|
|
).toMatchObject({
|
|
role: 'new',
|
|
resource: 'users.orders',
|
|
action: 'list',
|
|
});
|
|
|
|
expect(
|
|
acl.can({
|
|
role: 'new',
|
|
resource: 'orders',
|
|
action: 'list',
|
|
}),
|
|
).toMatchObject({
|
|
role: 'new',
|
|
resource: 'orders',
|
|
action: 'list',
|
|
});
|
|
});
|
|
});
|