tachybase_todo/packages/plugins/acl/src/__tests__/association-field.test.ts
ChengLei Shao a614bc7de8
feat: acl optimization (#1136)
* fix: sort field with table dose not have primary key

* feat: fixed params merger

* chore(plugins/acl): fixed params

* chore(plugins/acl): allowConfigure of collections

* chore(plugins/china-region): disable actions other than list

* chore(plugins/collection-manager): allowConfigure permission

* chore(plugins/file-manager): acl fixed params

* chore: acl fixed params

* chore: rolesResourcesScopes onDelete cascade

* fix: install error

* chore: test

* fix: root user fixed params

* fix: role resource scope onDelete

* chore: test

* chore: test

* fix: acl

* chore: disable index.html cache

* chore: disable index.html cache

* test: destory user role

* test: destory throught table

* fix: test

* fix: test

* chore: add rolesUsers to fixed params

* feat: permission logging

* feat: permission logging

* fix: test

* fix: test

* chore: disable grant target action

* fix: appends with fields

* fix: get action params

* fix: associationActions

* chore: change AssociationField using relation type

* chore: typo

* refactor: allow to skip

* fix: prettier

* chore: attachments association action

* fix: allowConfigure condition

* fix: deprecated allow

* fix: please use skip instead

* feat: table column aclcheck

* chore: test

* feat: throw error when detory no permission record

* chore: test

* chore: acl test

* feat: field acl

* chore: after action middleware

* fix: destory permission check

* chore: middleware use

* fix: test

* feat: filter match

* feat: subform/subtable field acl check

* feat: action permision by scope

* feat: action permision by scope

* feat: list action with allowedActions

* chore: all allowed action

* fix: pk error

* fix: merge error

* fix: create query sql

* fix: skip permission

* fix: scope with association field

* feat: action acl fix

* feat: action acl fix

* fix: update submodule

* Feat: setting center permission (#1214)

* feat: add setting center permissions

* feat: setting center permissions backlist

* feat: setting center permissions BLACKLIST

* feat: setting center permissions blacklist

* feat: setting center permissions blacklist

* feat: setting center permission

* feat: configure plugin tab expand

Co-authored-by: chenos <chenlinxh@gmail.com>

* Feat :field acl (#1211)

Co-authored-by: chenos <chenlinxh@gmail.com>

* fix: build error

* test: acl snippet

* feat: set field

* fix: test

* fix: build error

* fix: utils Dependency cycles

* feat: general permissions

* feat: delete pluginTabBlacklist

* fix: test

* feat: snippetManager allow method

* feat: acl role snippetAllowed method

* feat: array field repository

* feat:  ArrayFieldRepository

* fix: test

* fix: ci

* fix: ci error

* fix: add set parse

* test: array field repository

* chore: addSnippetPatten

* fix: start

* feat: sync role snippets

* feat: snippets check

* feat: snippets check

* chore: acl role snippet api

* fix: test

* fix: test

* refactor: acl role snippets

* chore: registerACLSettingSnippet

* chore: default snippets

* feat: snippets match

* feat: snippets check

* feat: snippets check

* feat: pm permision check

* feat: pm permision check

* feat: snippet pattern match

* feat: pluginManagerToolbar check

* feat: pluginManagerToolbar check

* chore: snippets default value

* feat: set role snippets migration

* chore: snippets

* feat: acl local

* feat: acl local

* feat: bookmask fix

* feat: plugin-manger & ui-editor snippet

* feat: set allowConfigure to false when upgrade to snippets

* feat: destory action acl fix

* feat: destory action acl fix

* fix: association resource params merge

* fix: ui editor snippet

* feat:  action acl fix

* chore: move list meta middleware into plugins/acl

* fix: test

* feat:  action acl fix

* feat: action acl check fix

* feat: plugins toolbar fix

* feat: gitmodules

* fix: subproject

* chore: add avaiableActions to snippet

* chore: change plugin-manager snippet

* feat: configure action acl fix

* feat: plugin tab acl check fix

* chore: roles snippets

* fix: add actions to snippet

* feat: allowconfigure fix

* fix: count with filterBy

* fix: build error

* feat: get action with allowedActions

* feat: acl route check fix

* feat:  aclActionProvider fix

* feat: actionscpe fix

* feat: actionname alias

* feat: setting center fix

* feat: acl provider fix

* fix: role collection

* feat: associate resource  acl

* feat: associate resource  acl

* feat: redirect to 403

* feat: route redirct

* feat:  acl scope check by record

* fix: fields  appends fix

* fix: fields  appends fix

* fix: fields  appends fix

* fix: allowedActions  fix

* fix:  menu items

* fix: rename

* fix: improve code

* fix: improve code

* fix: improve code

* fix: ctx?.data?.data

* fix: styling

* fix: allowAll after ignore scope

* chore: allowConfigure condition

* fix: collections.fields:*

* fix: acl test

* fix: update submodule

* fix: acl test

* fix: acl snippet

* fix: updates

* fix: only load history for logged-in users

* fix: this.app.acl.registerSnippet

* fix: downloadXlsxTemplate

* fix: 404

* feat: allowedAction in association list response

* fix: listData get

* fix: test

* fix: x-collection-field

* fix: update record error

* fix: calendar template

* test: allow manager

* fix: fetch action step

* fix: update submodule

* fix: refresh

* fix: refresh

* fix: rolesResourcesScopes

* test: snippets

* fix: snippets

* fix: test

* fix: omit filter.createdById

* fix: improve code

* fix: collections path

* fix: test error

* fix: upgrade error

* fix: errors

* fix: read allowed actions error

* fix: kanban error

* fix: error

Co-authored-by: chenos <chenlinxh@gmail.com>
Co-authored-by: katherinehhh <katherine_15995@163.com>
2023-01-09 07:35:48 +08:00

431 lines
8.9 KiB
TypeScript

import { ACL } from '@nocobase/acl';
import { Database, HasManyRepository } from '@nocobase/database';
import UsersPlugin from '@nocobase/plugin-users';
import { MockServer } from '@nocobase/test';
import { prepareApp } from './prepare';
describe('association test', () => {
let app: MockServer;
let db: Database;
let acl: ACL;
let user;
let userAgent;
let admin;
let adminAgent;
afterEach(async () => {
await app.destroy();
});
beforeEach(async () => {
app = await prepareApp();
db = app.db;
acl = app.acl;
});
it('should set association actions', async () => {
await db.getRepository('collections').create({
values: {
name: 'posts',
fields: [
{ name: 'title', type: 'string' },
{ name: 'userComments', type: 'hasMany', target: 'comments', interface: 'linkTo' },
],
},
context: {},
});
await db.getRepository('collections').create({
values: {
name: 'comments',
fields: [{ name: 'content', type: 'string' }],
},
context: {},
});
await db.getRepository('roles').create({
values: {
name: 'test-role',
},
context: {},
});
await db.getRepository('roles.resources', 'test-role').create({
values: {
name: 'posts',
usingActionsConfig: true,
actions: [
{
name: 'view',
fields: ['userComments'],
},
],
},
context: {},
});
const role = acl.getRole('test-role');
expect(
acl.can({
role: 'test-role',
action: 'list',
resource: 'posts.userComments',
}),
).not.toBeNull();
const post = await db.getRepository('posts').create({
values: {
title: 'hello world',
userComments: [{ content: 'comment 1' }],
},
});
const UserRepo = db.getCollection('users').repository;
const user = await UserRepo.create({
values: {
roles: ['test-role'],
},
});
const userPlugin = app.getPlugin('users') as UsersPlugin;
const userAgent = app.agent().auth(
userPlugin.jwtService.sign({
userId: user.get('id'),
}),
{ type: 'bearer' },
);
//@ts-ignore
const response = await userAgent.resource('posts').list({});
expect(response.statusCode).toEqual(200);
const post1 = response.body.data[0];
expect(post1.userComments).not.toBeDefined();
});
});
describe('association field acl', () => {
let app: MockServer;
let db: Database;
let acl: ACL;
let user;
let userAgent;
let admin;
let adminAgent;
afterEach(async () => {
await app.destroy();
});
beforeEach(async () => {
app = await prepareApp();
db = app.db;
acl = app.acl;
await db.getRepository('roles').create({
values: {
name: 'new',
},
});
await db.getRepository('roles').create({
values: {
name: 'testAdmin',
snippets: ['pm.*'],
},
});
const UserRepo = db.getCollection('users').repository;
user = await UserRepo.create({
values: {
roles: ['new'],
},
});
admin = await UserRepo.create({
values: {
roles: ['testAdmin'],
},
});
const userPlugin = app.getPlugin('users') as UsersPlugin;
userAgent = app.agent().auth(
userPlugin.jwtService.sign({
userId: user.get('id'),
}),
{ type: 'bearer' },
);
adminAgent = app.agent().auth(
userPlugin.jwtService.sign({
userId: admin.get('id'),
}),
{ type: 'bearer' },
);
await db.getRepository('collections').create({
values: {
name: 'orders',
},
context: {},
});
await db.getRepository('collections.fields', 'users').create({
values: {
name: 'name',
type: 'string',
},
context: {},
});
await db.getRepository('collections.fields', 'users').create({
values: {
name: 'age',
type: 'integer',
},
context: {},
});
await db.getRepository('collections.fields', 'users').create({
values: {
interface: 'linkTo',
name: 'orders',
type: 'hasMany',
target: 'orders',
},
context: {},
});
await db.getRepository('collections.fields', 'orders').create({
values: {
name: 'content',
type: 'string',
},
context: {},
});
await adminAgent.resource('roles.resources', 'new').create({
values: {
name: 'users',
usingActionsConfig: true,
actions: [
{
name: 'create',
fields: ['orders'],
},
{
name: 'view',
fields: ['orders'],
},
],
},
});
await adminAgent.resource('roles.resources', 'new').create({
values: {
name: 'orders',
usingActionsConfig: true,
actions: [
{
name: 'view',
},
],
},
});
});
// skip because of disable grant associations target action
it.skip('should revoke target action on association action revoke', async () => {
expect(
acl.can({
role: 'new',
resource: 'orders',
action: 'list',
}),
).toMatchObject({
role: 'new',
resource: 'orders',
action: 'list',
});
await adminAgent.resource('roles.resources', 'new').update({
values: {
name: 'users',
usingActionsConfig: true,
actions: [],
},
});
expect(
acl.can({
role: 'new',
resource: 'orders',
action: 'list',
}),
).toBeNull();
});
it('should revoke association action on action revoke', async () => {
expect(
acl.can({
role: 'new',
resource: 'users.orders',
action: 'add',
}),
).toMatchObject({
role: 'new',
resource: 'users.orders',
action: 'add',
});
const viewAction = await db.getRepository('rolesResourcesActions').findOne({
filter: {
name: 'view',
},
});
const actionId = viewAction.get('id') as number;
const response = await adminAgent.resource('roles.resources', 'new').update({
filterByTk: 'users',
values: {
name: 'users',
usingActionsConfig: true,
actions: [
{
id: actionId,
},
],
},
});
expect(response.statusCode).toEqual(200);
expect(
acl.can({
role: 'new',
resource: 'users.orders',
action: 'add',
}),
).toBeNull();
});
it('should revoke association action on field deleted', async () => {
await adminAgent.resource('roles.resources', 'new').update({
filterByTk: 'users',
values: {
name: 'users',
usingActionsConfig: true,
actions: [
{
name: 'create',
fields: ['name', 'age'],
},
],
},
});
expect(
acl.can({
role: 'new',
resource: 'users',
action: 'create',
}),
).toMatchObject({
role: 'new',
resource: 'users',
action: 'create',
params: {
whitelist: ['age', 'name'],
},
});
const roleResource = await db.getRepository('rolesResources').findOne({
filter: {
name: 'users',
},
});
const action = await db
.getRepository<HasManyRepository>('rolesResources.actions', roleResource.get('id') as string)
.findOne({
filter: {
name: 'create',
},
});
expect(action.get('fields').includes('name')).toBeTruthy();
// remove field
await db.getRepository<HasManyRepository>('collections.fields', 'users').destroy({
filter: {
name: 'name',
},
context: {},
});
expect(
acl.can({
role: 'new',
resource: 'users',
action: 'create',
}),
).toMatchObject({
role: 'new',
resource: 'users',
action: 'create',
params: {
whitelist: ['age'],
},
});
});
it('should allow association fields access', async () => {
const createResponse = await userAgent.resource('users').create({
values: {
orders: [
{
content: 'apple',
},
],
},
});
expect(createResponse.statusCode).toEqual(200);
const user = await db.getRepository('users').findOne({
filterByTk: createResponse.body.data.id,
});
// @ts-ignore
expect(await user.countOrders()).toEqual(1);
expect(
acl.can({
role: 'new',
resource: 'users.orders',
action: 'list',
}),
).toMatchObject({
role: 'new',
resource: 'users.orders',
action: 'list',
});
expect(
acl.can({
role: 'new',
resource: 'orders',
action: 'list',
}),
).toMatchObject({
role: 'new',
resource: 'orders',
action: 'list',
});
});
});