Add record access strategy
This commit is contained in:
Francisco Gaona
@@ -1,13 +1,28 @@
|
||||
import { Injectable, NotFoundException } from '@nestjs/common';
|
||||
import { Injectable, NotFoundException, Logger } from '@nestjs/common';
|
||||
import { TenantDatabaseService } from '../tenant/tenant-database.service';
|
||||
import { CustomMigrationService } from '../migration/custom-migration.service';
|
||||
import { ModelService } from './models/model.service';
|
||||
import { AuthorizationService } from '../rbac/authorization.service';
|
||||
import { ObjectDefinition } from '../models/object-definition.model';
|
||||
import { FieldDefinition } from '../models/field-definition.model';
|
||||
import { User } from '../models/user.model';
|
||||
import { ObjectMetadata } from './models/dynamic-model.factory';
|
||||
|
||||
@Injectable()
|
||||
export class ObjectService {
|
||||
constructor(private tenantDbService: TenantDatabaseService) {}
|
||||
private readonly logger = new Logger(ObjectService.name);
|
||||
|
||||
constructor(
|
||||
private tenantDbService: TenantDatabaseService,
|
||||
private customMigrationService: CustomMigrationService,
|
||||
private modelService: ModelService,
|
||||
private authService: AuthorizationService,
|
||||
) {}
|
||||
|
||||
// Setup endpoints - Object metadata management
|
||||
async getObjectDefinitions(tenantId: string) {
|
||||
const knex = await this.tenantDbService.getTenantKnex(tenantId);
|
||||
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
|
||||
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
|
||||
|
||||
const objects = await knex('object_definitions')
|
||||
.select('object_definitions.*')
|
||||
@@ -28,7 +43,8 @@ export class ObjectService {
|
||||
}
|
||||
|
||||
async getObjectDefinition(tenantId: string, apiName: string) {
|
||||
const knex = await this.tenantDbService.getTenantKnex(tenantId);
|
||||
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
|
||||
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
|
||||
|
||||
const obj = await knex('object_definitions')
|
||||
.where({ apiName })
|
||||
@@ -43,6 +59,9 @@ export class ObjectService {
|
||||
.where({ objectDefinitionId: obj.id })
|
||||
.orderBy('label', 'asc');
|
||||
|
||||
// Normalize all fields to ensure system fields are properly marked
|
||||
const normalizedFields = fields.map((field: any) => this.normalizeField(field));
|
||||
|
||||
// Get app information if object belongs to an app
|
||||
let app = null;
|
||||
if (obj.app_id) {
|
||||
@@ -54,7 +73,7 @@ export class ObjectService {
|
||||
|
||||
return {
|
||||
...obj,
|
||||
fields,
|
||||
fields: normalizedFields,
|
||||
app,
|
||||
};
|
||||
}
|
||||
@@ -69,15 +88,172 @@ export class ObjectService {
|
||||
isSystem?: boolean;
|
||||
},
|
||||
) {
|
||||
const knex = await this.tenantDbService.getTenantKnex(tenantId);
|
||||
const [id] = await knex('object_definitions').insert({
|
||||
id: knex.raw('(UUID())'),
|
||||
// Resolve tenant ID in case a slug was passed
|
||||
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
|
||||
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
|
||||
|
||||
// Generate UUID for the new object
|
||||
const objectId = require('crypto').randomUUID();
|
||||
|
||||
// Create the object definition record
|
||||
await knex('object_definitions').insert({
|
||||
id: objectId,
|
||||
...data,
|
||||
created_at: knex.fn.now(),
|
||||
updated_at: knex.fn.now(),
|
||||
});
|
||||
|
||||
return knex('object_definitions').where({ id }).first();
|
||||
const objectDef = await knex('object_definitions').where({ id: objectId }).first();
|
||||
|
||||
// Create standard field definitions (only if they don't already exist)
|
||||
const standardFields = [
|
||||
{
|
||||
apiName: 'ownerId',
|
||||
label: 'Owner',
|
||||
type: 'LOOKUP',
|
||||
description: 'The user who owns this record',
|
||||
isRequired: false, // Auto-set by system
|
||||
isUnique: false,
|
||||
referenceObject: 'User',
|
||||
isSystem: true,
|
||||
isCustom: false,
|
||||
},
|
||||
{
|
||||
apiName: 'name',
|
||||
label: 'Name',
|
||||
type: 'STRING',
|
||||
description: 'The primary name field for this record',
|
||||
isRequired: false, // Optional field
|
||||
isUnique: false,
|
||||
referenceObject: null,
|
||||
isSystem: false,
|
||||
isCustom: false,
|
||||
},
|
||||
{
|
||||
apiName: 'created_at',
|
||||
label: 'Created At',
|
||||
type: 'DATE_TIME',
|
||||
description: 'The timestamp when this record was created',
|
||||
isRequired: false, // Auto-set by system
|
||||
isUnique: false,
|
||||
referenceObject: null,
|
||||
isSystem: true,
|
||||
isCustom: false,
|
||||
},
|
||||
{
|
||||
apiName: 'updated_at',
|
||||
label: 'Updated At',
|
||||
type: 'DATE_TIME',
|
||||
description: 'The timestamp when this record was last updated',
|
||||
isRequired: false, // Auto-set by system
|
||||
isUnique: false,
|
||||
referenceObject: null,
|
||||
isSystem: true,
|
||||
isCustom: false,
|
||||
},
|
||||
];
|
||||
|
||||
// Insert standard field definitions that don't already exist
|
||||
for (const field of standardFields) {
|
||||
const existingField = await knex('field_definitions')
|
||||
.where({
|
||||
objectDefinitionId: objectDef.id,
|
||||
apiName: field.apiName,
|
||||
})
|
||||
.first();
|
||||
|
||||
if (!existingField) {
|
||||
const fieldData: any = {
|
||||
id: knex.raw('(UUID())'),
|
||||
objectDefinitionId: objectDef.id,
|
||||
...field,
|
||||
created_at: knex.fn.now(),
|
||||
updated_at: knex.fn.now(),
|
||||
};
|
||||
|
||||
// For lookup fields, set ui_metadata with relationDisplayField
|
||||
if (field.type === 'LOOKUP') {
|
||||
fieldData.ui_metadata = JSON.stringify({
|
||||
relationDisplayField: 'name',
|
||||
});
|
||||
}
|
||||
|
||||
await knex('field_definitions').insert(fieldData);
|
||||
}
|
||||
}
|
||||
|
||||
// Create a migration to create the table
|
||||
const tableName = this.getTableName(data.apiName);
|
||||
const createTableSQL = this.customMigrationService.generateCreateTableSQL(tableName);
|
||||
|
||||
try {
|
||||
await this.customMigrationService.createAndExecuteMigration(
|
||||
knex,
|
||||
resolvedTenantId,
|
||||
{
|
||||
name: `create_${tableName}_table`,
|
||||
description: `Create table for ${data.label} object`,
|
||||
type: 'create_table',
|
||||
sql: createTableSQL,
|
||||
},
|
||||
);
|
||||
} catch (error) {
|
||||
// Log the error but don't fail - migration is recorded for future retry
|
||||
console.error(`Failed to execute table creation migration: ${error.message}`);
|
||||
}
|
||||
|
||||
// Create and register the Objection model for this object
|
||||
try {
|
||||
const allFields = await knex('field_definitions')
|
||||
.where({ objectDefinitionId: objectDef.id })
|
||||
.select('apiName', 'label', 'type', 'isRequired', 'isUnique', 'referenceObject');
|
||||
|
||||
const objectMetadata: ObjectMetadata = {
|
||||
apiName: data.apiName,
|
||||
tableName,
|
||||
fields: allFields.map((f: any) => ({
|
||||
apiName: f.apiName,
|
||||
label: f.label,
|
||||
type: f.type,
|
||||
isRequired: f.isRequired,
|
||||
isUnique: f.isUnique,
|
||||
referenceObject: f.referenceObject,
|
||||
})),
|
||||
relations: [],
|
||||
};
|
||||
|
||||
await this.modelService.createModelForObject(resolvedTenantId, objectMetadata);
|
||||
} catch (error) {
|
||||
console.error(`Failed to create model for object ${data.apiName}:`, error.message);
|
||||
}
|
||||
|
||||
return objectDef;
|
||||
}
|
||||
|
||||
async updateObjectDefinition(
|
||||
tenantId: string,
|
||||
objectApiName: string,
|
||||
data: Partial<{
|
||||
label: string;
|
||||
pluralLabel: string;
|
||||
description: string;
|
||||
orgWideDefault: 'private' | 'public_read' | 'public_read_write';
|
||||
}>,
|
||||
) {
|
||||
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
|
||||
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
|
||||
|
||||
// Update the object definition
|
||||
await ObjectDefinition.query(knex)
|
||||
.findOne({ apiName: objectApiName })
|
||||
.patch({
|
||||
...data,
|
||||
updatedAt: new Date(),
|
||||
});
|
||||
|
||||
// Return updated object
|
||||
return await ObjectDefinition.query(knex)
|
||||
.findOne({ apiName: objectApiName });
|
||||
}
|
||||
|
||||
async createFieldDefinition(
|
||||
@@ -91,19 +267,44 @@ export class ObjectService {
|
||||
isRequired?: boolean;
|
||||
isUnique?: boolean;
|
||||
referenceObject?: string;
|
||||
relationObject?: string;
|
||||
relationDisplayField?: string;
|
||||
defaultValue?: string;
|
||||
},
|
||||
) {
|
||||
const knex = await this.tenantDbService.getTenantKnex(tenantId);
|
||||
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
|
||||
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
|
||||
const obj = await this.getObjectDefinition(tenantId, objectApiName);
|
||||
|
||||
const [id] = await knex('field_definitions').insert({
|
||||
// Convert frontend type to database type
|
||||
const dbFieldType = this.convertFrontendFieldType(data.type);
|
||||
|
||||
// Use relationObject if provided (alias for referenceObject)
|
||||
const referenceObject = data.referenceObject || data.relationObject;
|
||||
|
||||
const fieldData: any = {
|
||||
id: knex.raw('(UUID())'),
|
||||
objectDefinitionId: obj.id,
|
||||
...data,
|
||||
apiName: data.apiName,
|
||||
label: data.label,
|
||||
type: dbFieldType,
|
||||
description: data.description,
|
||||
isRequired: data.isRequired ?? false,
|
||||
isUnique: data.isUnique ?? false,
|
||||
referenceObject: referenceObject,
|
||||
defaultValue: data.defaultValue,
|
||||
created_at: knex.fn.now(),
|
||||
updated_at: knex.fn.now(),
|
||||
});
|
||||
};
|
||||
|
||||
// Store relationDisplayField in UI metadata if provided
|
||||
if (data.relationDisplayField) {
|
||||
fieldData.ui_metadata = JSON.stringify({
|
||||
relationDisplayField: data.relationDisplayField,
|
||||
});
|
||||
}
|
||||
|
||||
const [id] = await knex('field_definitions').insert(fieldData);
|
||||
|
||||
return knex('field_definitions').where({ id }).first();
|
||||
}
|
||||
@@ -127,6 +328,116 @@ export class ObjectService {
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Normalize field definition to ensure system fields are properly marked
|
||||
*/
|
||||
private normalizeField(field: any): any {
|
||||
const systemFieldNames = ['id', 'tenantId', 'ownerId', 'created_at', 'updated_at', 'createdAt', 'updatedAt'];
|
||||
const isSystemField = systemFieldNames.includes(field.apiName);
|
||||
|
||||
return {
|
||||
...field,
|
||||
// Ensure system fields are marked correctly
|
||||
isSystem: isSystemField ? true : field.isSystem,
|
||||
isRequired: isSystemField ? false : field.isRequired,
|
||||
isCustom: isSystemField ? false : field.isCustom ?? true,
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Convert frontend field type to database field type
|
||||
*/
|
||||
private convertFrontendFieldType(frontendType: string): string {
|
||||
const typeMap: Record<string, string> = {
|
||||
'text': 'TEXT',
|
||||
'textarea': 'LONG_TEXT',
|
||||
'password': 'TEXT',
|
||||
'email': 'EMAIL',
|
||||
'number': 'NUMBER',
|
||||
'currency': 'CURRENCY',
|
||||
'percent': 'PERCENT',
|
||||
'select': 'PICKLIST',
|
||||
'multiSelect': 'MULTI_PICKLIST',
|
||||
'boolean': 'BOOLEAN',
|
||||
'date': 'DATE',
|
||||
'datetime': 'DATE_TIME',
|
||||
'time': 'TIME',
|
||||
'url': 'URL',
|
||||
'color': 'TEXT',
|
||||
'json': 'JSON',
|
||||
'belongsTo': 'LOOKUP',
|
||||
'hasMany': 'LOOKUP',
|
||||
'manyToMany': 'LOOKUP',
|
||||
'markdown': 'LONG_TEXT',
|
||||
'code': 'LONG_TEXT',
|
||||
'file': 'FILE',
|
||||
'image': 'IMAGE',
|
||||
};
|
||||
|
||||
return typeMap[frontendType] || 'TEXT';
|
||||
}
|
||||
|
||||
/**
|
||||
* Ensure a model is registered for the given object.
|
||||
* Delegates to ModelService which handles creating the model and all its dependencies.
|
||||
*/
|
||||
private async ensureModelRegistered(
|
||||
tenantId: string,
|
||||
objectApiName: string,
|
||||
): Promise<void> {
|
||||
// Provide a metadata fetcher function that the ModelService can use
|
||||
const fetchMetadata = async (apiName: string): Promise<ObjectMetadata> => {
|
||||
const objectDef = await this.getObjectDefinition(tenantId, apiName);
|
||||
const tableName = this.getTableName(apiName);
|
||||
|
||||
// Build relations from lookup fields, but only for models that exist
|
||||
const lookupFields = objectDef.fields.filter((f: any) =>
|
||||
f.type === 'LOOKUP' && f.referenceObject
|
||||
);
|
||||
|
||||
// Filter to only include relations where we can successfully resolve the target
|
||||
const validRelations: any[] = [];
|
||||
for (const field of lookupFields) {
|
||||
// Check if the referenced object will be available
|
||||
// We'll let the recursive registration attempt it, but won't include failed ones
|
||||
validRelations.push({
|
||||
name: field.apiName.replace(/Id$/, '').toLowerCase(),
|
||||
type: 'belongsTo' as const,
|
||||
targetObjectApiName: field.referenceObject,
|
||||
fromColumn: field.apiName,
|
||||
toColumn: 'id',
|
||||
});
|
||||
}
|
||||
|
||||
return {
|
||||
apiName,
|
||||
tableName,
|
||||
fields: objectDef.fields.map((f: any) => ({
|
||||
apiName: f.apiName,
|
||||
label: f.label,
|
||||
type: f.type,
|
||||
isRequired: f.isRequired,
|
||||
isUnique: f.isUnique,
|
||||
referenceObject: f.referenceObject,
|
||||
})),
|
||||
relations: validRelations,
|
||||
};
|
||||
};
|
||||
|
||||
// Let the ModelService handle recursive model creation
|
||||
try {
|
||||
await this.modelService.ensureModelWithDependencies(
|
||||
tenantId,
|
||||
objectApiName,
|
||||
fetchMetadata,
|
||||
);
|
||||
} catch (error) {
|
||||
this.logger.warn(
|
||||
`Failed to ensure model for ${objectApiName}: ${error.message}. Will fall back to manual hydration.`,
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
// Runtime endpoints - CRUD operations
|
||||
async getRecords(
|
||||
tenantId: string,
|
||||
@@ -134,19 +445,60 @@ export class ObjectService {
|
||||
userId: string,
|
||||
filters?: any,
|
||||
) {
|
||||
const knex = await this.tenantDbService.getTenantKnex(tenantId);
|
||||
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
|
||||
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
|
||||
|
||||
// Verify object exists
|
||||
await this.getObjectDefinition(tenantId, objectApiName);
|
||||
// Get user with roles and permissions
|
||||
const user = await User.query(knex)
|
||||
.findById(userId)
|
||||
.withGraphFetched('[roles.[objectPermissions, fieldPermissions]]');
|
||||
|
||||
if (!user) {
|
||||
throw new NotFoundException('User not found');
|
||||
}
|
||||
|
||||
// Get object definition with authorization settings
|
||||
const objectDefModel = await ObjectDefinition.query(knex)
|
||||
.findOne({ apiName: objectApiName })
|
||||
.withGraphFetched('fields');
|
||||
|
||||
if (!objectDefModel) {
|
||||
throw new NotFoundException(`Object ${objectApiName} not found`);
|
||||
}
|
||||
|
||||
const tableName = this.getTableName(objectApiName);
|
||||
|
||||
let query = knex(tableName);
|
||||
// Ensure model is registered
|
||||
await this.ensureModelRegistered(resolvedTenantId, objectApiName);
|
||||
|
||||
// Use Objection model
|
||||
const boundModel = await this.modelService.getBoundModel(resolvedTenantId, objectApiName);
|
||||
let query = boundModel.query();
|
||||
|
||||
// Add ownership filter if ownerId field exists
|
||||
const hasOwner = await knex.schema.hasColumn(tableName, 'ownerId');
|
||||
if (hasOwner) {
|
||||
query = query.where({ ownerId: userId });
|
||||
// Apply authorization scope (modifies query in place)
|
||||
await this.authService.applyScopeToQuery(
|
||||
query,
|
||||
objectDefModel,
|
||||
user,
|
||||
'read',
|
||||
knex,
|
||||
);
|
||||
|
||||
// Build graph expression for lookup fields
|
||||
const lookupFields = objectDefModel.fields?.filter(f =>
|
||||
f.type === 'LOOKUP' && f.referenceObject
|
||||
) || [];
|
||||
|
||||
if (lookupFields.length > 0) {
|
||||
// Build relation expression - use singular lowercase for relation name
|
||||
const relationExpression = lookupFields
|
||||
.map(f => f.apiName.replace(/Id$/, '').toLowerCase())
|
||||
.filter(Boolean)
|
||||
.join(', ');
|
||||
|
||||
if (relationExpression) {
|
||||
query = query.withGraphFetched(`[${relationExpression}]`);
|
||||
}
|
||||
}
|
||||
|
||||
// Apply additional filters
|
||||
@@ -154,7 +506,16 @@ export class ObjectService {
|
||||
query = query.where(filters);
|
||||
}
|
||||
|
||||
return query.select('*');
|
||||
const records = await query.select('*');
|
||||
|
||||
// Filter fields based on field-level permissions
|
||||
const filteredRecords = await Promise.all(
|
||||
records.map(record =>
|
||||
this.authService.filterReadableFields(record, objectDefModel.fields, user)
|
||||
)
|
||||
);
|
||||
|
||||
return filteredRecords;
|
||||
}
|
||||
|
||||
async getRecord(
|
||||
@@ -163,28 +524,69 @@ export class ObjectService {
|
||||
recordId: string,
|
||||
userId: string,
|
||||
) {
|
||||
const knex = await this.tenantDbService.getTenantKnex(tenantId);
|
||||
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
|
||||
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
|
||||
|
||||
// Verify object exists
|
||||
await this.getObjectDefinition(tenantId, objectApiName);
|
||||
// Get user with roles and permissions
|
||||
const user = await User.query(knex)
|
||||
.findById(userId)
|
||||
.withGraphFetched('[roles.[objectPermissions, fieldPermissions]]');
|
||||
|
||||
const tableName = this.getTableName(objectApiName);
|
||||
if (!user) {
|
||||
throw new NotFoundException('User not found');
|
||||
}
|
||||
|
||||
let query = knex(tableName).where({ id: recordId });
|
||||
// Get object definition with authorization settings
|
||||
const objectDefModel = await ObjectDefinition.query(knex)
|
||||
.findOne({ apiName: objectApiName })
|
||||
.withGraphFetched('fields');
|
||||
|
||||
// Add ownership filter if ownerId field exists
|
||||
const hasOwner = await knex.schema.hasColumn(tableName, 'ownerId');
|
||||
if (hasOwner) {
|
||||
query = query.where({ ownerId: userId });
|
||||
if (!objectDefModel) {
|
||||
throw new NotFoundException(`Object ${objectApiName} not found`);
|
||||
}
|
||||
|
||||
// Ensure model is registered
|
||||
await this.ensureModelRegistered(resolvedTenantId, objectApiName);
|
||||
|
||||
// Use Objection model
|
||||
const boundModel = await this.modelService.getBoundModel(resolvedTenantId, objectApiName);
|
||||
let query = boundModel.query().where({ id: recordId });
|
||||
|
||||
// Apply authorization scope (modifies query in place)
|
||||
await this.authService.applyScopeToQuery(
|
||||
query,
|
||||
objectDefModel,
|
||||
user,
|
||||
'read',
|
||||
knex,
|
||||
);
|
||||
|
||||
// Build graph expression for lookup fields
|
||||
const lookupFields = objectDefModel.fields?.filter(f =>
|
||||
f.type === 'LOOKUP' && f.referenceObject
|
||||
) || [];
|
||||
|
||||
if (lookupFields.length > 0) {
|
||||
// Build relation expression - use singular lowercase for relation name
|
||||
const relationExpression = lookupFields
|
||||
.map(f => f.apiName.replace(/Id$/, '').toLowerCase())
|
||||
.filter(Boolean)
|
||||
.join(', ');
|
||||
|
||||
if (relationExpression) {
|
||||
query = query.withGraphFetched(`[${relationExpression}]`);
|
||||
}
|
||||
}
|
||||
|
||||
const record = await query.first();
|
||||
|
||||
if (!record) {
|
||||
throw new NotFoundException('Record not found');
|
||||
}
|
||||
|
||||
return record;
|
||||
|
||||
// Filter fields based on field-level permissions
|
||||
const filteredRecord = await this.authService.filterReadableFields(record, objectDefModel.fields, user);
|
||||
|
||||
return filteredRecord;
|
||||
}
|
||||
|
||||
async createRecord(
|
||||
@@ -193,30 +595,47 @@ export class ObjectService {
|
||||
data: any,
|
||||
userId: string,
|
||||
) {
|
||||
const knex = await this.tenantDbService.getTenantKnex(tenantId);
|
||||
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
|
||||
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
|
||||
|
||||
// Verify object exists
|
||||
await this.getObjectDefinition(tenantId, objectApiName);
|
||||
// Get user with roles and permissions
|
||||
const user = await User.query(knex)
|
||||
.findById(userId)
|
||||
.withGraphFetched('[roles.[objectPermissions, fieldPermissions]]');
|
||||
|
||||
const tableName = this.getTableName(objectApiName);
|
||||
|
||||
// Check if table has ownerId column
|
||||
const hasOwner = await knex.schema.hasColumn(tableName, 'ownerId');
|
||||
|
||||
const recordData: any = {
|
||||
id: knex.raw('(UUID())'),
|
||||
...data,
|
||||
created_at: knex.fn.now(),
|
||||
updated_at: knex.fn.now(),
|
||||
};
|
||||
|
||||
if (hasOwner) {
|
||||
recordData.ownerId = userId;
|
||||
if (!user) {
|
||||
throw new NotFoundException('User not found');
|
||||
}
|
||||
|
||||
const [id] = await knex(tableName).insert(recordData);
|
||||
// Get object definition with authorization settings
|
||||
const objectDefModel = await ObjectDefinition.query(knex)
|
||||
.findOne({ apiName: objectApiName })
|
||||
.withGraphFetched('fields');
|
||||
|
||||
return knex(tableName).where({ id }).first();
|
||||
if (!objectDefModel) {
|
||||
throw new NotFoundException(`Object ${objectApiName} not found`);
|
||||
}
|
||||
|
||||
// Check if user has create permission
|
||||
const canCreate = await this.authService.canCreate(objectDefModel, user);
|
||||
if (!canCreate) {
|
||||
throw new NotFoundException('You do not have permission to create records of this object');
|
||||
}
|
||||
|
||||
// Filter data to only editable fields
|
||||
const editableData = await this.authService.filterEditableFields(data, objectDefModel.fields, user);
|
||||
|
||||
// Ensure model is registered
|
||||
await this.ensureModelRegistered(resolvedTenantId, objectApiName);
|
||||
|
||||
// Use Objection model
|
||||
const boundModel = await this.modelService.getBoundModel(resolvedTenantId, objectApiName);
|
||||
const recordData = {
|
||||
...editableData,
|
||||
ownerId: userId, // Auto-set owner
|
||||
};
|
||||
const record = await boundModel.query().insert(recordData);
|
||||
return record;
|
||||
}
|
||||
|
||||
async updateRecord(
|
||||
@@ -226,18 +645,54 @@ export class ObjectService {
|
||||
data: any,
|
||||
userId: string,
|
||||
) {
|
||||
const knex = await this.tenantDbService.getTenantKnex(tenantId);
|
||||
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
|
||||
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
|
||||
|
||||
// Verify object exists and user has access
|
||||
await this.getRecord(tenantId, objectApiName, recordId, userId);
|
||||
// Get user with roles and permissions
|
||||
const user = await User.query(knex)
|
||||
.findById(userId)
|
||||
.withGraphFetched('[roles.[objectPermissions, fieldPermissions]]');
|
||||
|
||||
if (!user) {
|
||||
throw new NotFoundException('User not found');
|
||||
}
|
||||
|
||||
// Get object definition with authorization settings
|
||||
const objectDefModel = await ObjectDefinition.query(knex)
|
||||
.findOne({ apiName: objectApiName })
|
||||
.withGraphFetched('fields');
|
||||
|
||||
if (!objectDefModel) {
|
||||
throw new NotFoundException(`Object ${objectApiName} not found`);
|
||||
}
|
||||
|
||||
const tableName = this.getTableName(objectApiName);
|
||||
|
||||
await knex(tableName)
|
||||
.where({ id: recordId })
|
||||
.update({ ...data, updated_at: knex.fn.now() });
|
||||
|
||||
return knex(tableName).where({ id: recordId }).first();
|
||||
// Get existing record
|
||||
const existingRecord = await knex(tableName).where({ id: recordId }).first();
|
||||
if (!existingRecord) {
|
||||
throw new NotFoundException('Record not found');
|
||||
}
|
||||
|
||||
// Check if user can update this record
|
||||
await this.authService.assertCanPerformAction('update', objectDefModel, existingRecord, user, knex);
|
||||
|
||||
// Filter data to only editable fields
|
||||
const editableData = await this.authService.filterEditableFields(data, objectDefModel.fields, user);
|
||||
|
||||
// Remove system fields
|
||||
delete editableData.id;
|
||||
delete editableData.ownerId;
|
||||
delete editableData.created_at;
|
||||
delete editableData.tenantId;
|
||||
|
||||
// Ensure model is registered
|
||||
await this.ensureModelRegistered(resolvedTenantId, objectApiName);
|
||||
|
||||
// Use Objection model
|
||||
const boundModel = await this.modelService.getBoundModel(resolvedTenantId, objectApiName);
|
||||
await boundModel.query().where({ id: recordId }).update(editableData);
|
||||
return boundModel.query().where({ id: recordId }).first();
|
||||
}
|
||||
|
||||
async deleteRecord(
|
||||
@@ -246,14 +701,201 @@ export class ObjectService {
|
||||
recordId: string,
|
||||
userId: string,
|
||||
) {
|
||||
const knex = await this.tenantDbService.getTenantKnex(tenantId);
|
||||
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
|
||||
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
|
||||
|
||||
// Verify object exists and user has access
|
||||
await this.getRecord(tenantId, objectApiName, recordId, userId);
|
||||
// Get user with roles and permissions
|
||||
const user = await User.query(knex)
|
||||
.findById(userId)
|
||||
.withGraphFetched('[roles.[objectPermissions, fieldPermissions]]');
|
||||
|
||||
if (!user) {
|
||||
throw new NotFoundException('User not found');
|
||||
}
|
||||
|
||||
// Get object definition with authorization settings
|
||||
const objectDefModel = await ObjectDefinition.query(knex)
|
||||
.findOne({ apiName: objectApiName });
|
||||
|
||||
if (!objectDefModel) {
|
||||
throw new NotFoundException(`Object ${objectApiName} not found`);
|
||||
}
|
||||
|
||||
const tableName = this.getTableName(objectApiName);
|
||||
|
||||
// Get existing record
|
||||
const existingRecord = await knex(tableName).where({ id: recordId }).first();
|
||||
if (!existingRecord) {
|
||||
throw new NotFoundException('Record not found');
|
||||
}
|
||||
|
||||
// Check if user can delete this record
|
||||
await this.authService.assertCanPerformAction('delete', objectDefModel, existingRecord, user, knex);
|
||||
|
||||
await knex(tableName).where({ id: recordId }).delete();
|
||||
// Ensure model is registered
|
||||
await this.ensureModelRegistered(resolvedTenantId, objectApiName);
|
||||
|
||||
// Use Objection model
|
||||
const boundModel = await this.modelService.getBoundModel(resolvedTenantId, objectApiName);
|
||||
await boundModel.query().where({ id: recordId }).delete();
|
||||
|
||||
return { success: true };
|
||||
}
|
||||
|
||||
async getFieldPermissions(tenantId: string, objectId: string) {
|
||||
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
|
||||
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
|
||||
|
||||
// Get all field permissions for this object's fields
|
||||
const permissions = await knex('role_field_permissions as rfp')
|
||||
.join('field_definitions as fd', 'fd.id', 'rfp.fieldDefinitionId')
|
||||
.where('fd.objectDefinitionId', objectId)
|
||||
.select('rfp.*');
|
||||
|
||||
return permissions;
|
||||
}
|
||||
|
||||
async updateFieldPermission(
|
||||
tenantId: string,
|
||||
roleId: string,
|
||||
fieldDefinitionId: string,
|
||||
canRead: boolean,
|
||||
canEdit: boolean,
|
||||
) {
|
||||
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
|
||||
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
|
||||
|
||||
// Check if permission already exists
|
||||
const existing = await knex('role_field_permissions')
|
||||
.where({ roleId, fieldDefinitionId })
|
||||
.first();
|
||||
|
||||
if (existing) {
|
||||
// Update existing permission
|
||||
await knex('role_field_permissions')
|
||||
.where({ roleId, fieldDefinitionId })
|
||||
.update({
|
||||
canRead,
|
||||
canEdit,
|
||||
updated_at: knex.fn.now(),
|
||||
});
|
||||
} else {
|
||||
// Create new permission
|
||||
await knex('role_field_permissions').insert({
|
||||
id: knex.raw('(UUID())'),
|
||||
roleId,
|
||||
fieldDefinitionId,
|
||||
canRead,
|
||||
canEdit,
|
||||
created_at: knex.fn.now(),
|
||||
updated_at: knex.fn.now(),
|
||||
});
|
||||
}
|
||||
|
||||
return { success: true };
|
||||
}
|
||||
|
||||
async getObjectPermissions(
|
||||
tenantId: string,
|
||||
objectApiName: string,
|
||||
roleId: string,
|
||||
) {
|
||||
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
|
||||
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
|
||||
|
||||
// Get object definition
|
||||
const objectDef = await ObjectDefinition.query(knex)
|
||||
.findOne({ apiName: objectApiName });
|
||||
|
||||
if (!objectDef) {
|
||||
throw new NotFoundException(`Object ${objectApiName} not found`);
|
||||
}
|
||||
|
||||
// Get role object permissions
|
||||
const permission = await knex('role_object_permissions')
|
||||
.where({ roleId, objectDefinitionId: objectDef.id })
|
||||
.first();
|
||||
|
||||
if (!permission) {
|
||||
// Return default permissions (all false)
|
||||
return {
|
||||
canCreate: false,
|
||||
canRead: false,
|
||||
canEdit: false,
|
||||
canDelete: false,
|
||||
canViewAll: false,
|
||||
canModifyAll: false,
|
||||
};
|
||||
}
|
||||
|
||||
return {
|
||||
canCreate: Boolean(permission.canCreate),
|
||||
canRead: Boolean(permission.canRead),
|
||||
canEdit: Boolean(permission.canEdit),
|
||||
canDelete: Boolean(permission.canDelete),
|
||||
canViewAll: Boolean(permission.canViewAll),
|
||||
canModifyAll: Boolean(permission.canModifyAll),
|
||||
};
|
||||
}
|
||||
|
||||
async updateObjectPermissions(
|
||||
tenantId: string,
|
||||
objectApiName: string,
|
||||
data: {
|
||||
roleId: string;
|
||||
canCreate: boolean;
|
||||
canRead: boolean;
|
||||
canEdit: boolean;
|
||||
canDelete: boolean;
|
||||
canViewAll: boolean;
|
||||
canModifyAll: boolean;
|
||||
},
|
||||
) {
|
||||
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
|
||||
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
|
||||
|
||||
// Get object definition
|
||||
const objectDef = await ObjectDefinition.query(knex)
|
||||
.findOne({ apiName: objectApiName });
|
||||
|
||||
if (!objectDef) {
|
||||
throw new NotFoundException(`Object ${objectApiName} not found`);
|
||||
}
|
||||
|
||||
// Check if permission already exists
|
||||
const existing = await knex('role_object_permissions')
|
||||
.where({ roleId: data.roleId, objectDefinitionId: objectDef.id })
|
||||
.first();
|
||||
|
||||
if (existing) {
|
||||
// Update existing permission
|
||||
await knex('role_object_permissions')
|
||||
.where({ roleId: data.roleId, objectDefinitionId: objectDef.id })
|
||||
.update({
|
||||
canCreate: data.canCreate,
|
||||
canRead: data.canRead,
|
||||
canEdit: data.canEdit,
|
||||
canDelete: data.canDelete,
|
||||
canViewAll: data.canViewAll,
|
||||
canModifyAll: data.canModifyAll,
|
||||
updated_at: knex.fn.now(),
|
||||
});
|
||||
} else {
|
||||
// Create new permission
|
||||
await knex('role_object_permissions').insert({
|
||||
id: knex.raw('(UUID())'),
|
||||
roleId: data.roleId,
|
||||
objectDefinitionId: objectDef.id,
|
||||
canCreate: data.canCreate,
|
||||
canRead: data.canRead,
|
||||
canEdit: data.canEdit,
|
||||
canDelete: data.canDelete,
|
||||
canViewAll: data.canViewAll,
|
||||
canModifyAll: data.canModifyAll,
|
||||
created_at: knex.fn.now(),
|
||||
updated_at: knex.fn.now(),
|
||||
});
|
||||
}
|
||||
|
||||
return { success: true };
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user