neogenia/neo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: neogenia:permissions
Branches Tags
neogenia:master neogenia:aiprocessbuilder2 neogenia:copilot-worktree-2026-01-31T01-10-57 neogenia:list-view-search neogenia:codex/add-contact-and-contact-details-objects neogenia:drawer neogenia:managefields neogenia:feature/salesforce-authorization neogenia:feature/twilio neogenia:permissions neogenia:schemaoperations neogenia:pagelayouts
..
compare: neogenia:3086f78d3412ade68e899ba524aac14217aba6a9
Branches Tags
neogenia:aiprocessbuilder2 neogenia:master neogenia:copilot-worktree-2026-01-31T01-10-57 neogenia:list-view-search neogenia:codex/add-contact-and-contact-details-objects neogenia:drawer neogenia:managefields neogenia:feature/salesforce-authorization neogenia:feature/twilio neogenia:permissions neogenia:schemaoperations neogenia:pagelayouts

6 Commits
permission ... 3086f78d34

Author SHA1 Message Date
Francisco Gaona
3086f78d34 WIp - manage role permissions per object 2025-12-30 06:16:54 +01:00
Francisco Gaona
d15fc918d1 WIP - field level permission 2025-12-30 05:54:56 +01:00
Francisco Gaona
56c0c3838d WIP - permissions working as expected 2025-12-30 04:50:51 +01:00
Francisco Gaona
9ac69e30d0 WIP - better handling of viewAll modifyAll 2025-12-30 04:43:51 +01:00
Francisco Gaona
d37183ba45 WIp - fix displaying related model names in lookup fields 2025-12-30 04:22:56 +01:00
Francisco Gaona
b4bdeeb9f6 WIP - permissions progress 2025-12-30 03:26:50 +01:00
55 changed files with 2146 additions and 3937 deletions
Expand all files Collapse all files

251
IMPLEMENTATION_SUMMARY.md
View File

@@ -1,251 +0,0 @@
# Authorization System Implementation Summary
## ✅ Implementation Complete
A comprehensive polymorphic record sharing and authorization system has been implemented with CASL, Objection.js, and NestJS.
## What Was Built
### Backend (NestJS + Objection.js + CASL)
#### 1. Database Layer
- ✅ Migration for authorization tables (`20250128000001_add_authorization_system.js`)
- ✅ Updated Prisma schema with new models
- ✅ Objection.js models: `ObjectField`, `RoleRule`, `RecordShare`
- ✅ Updated existing models with new relations
#### 2. Authorization Core
- ✅ `AbilityFactory` - Builds CASL abilities from 3 layers (global, role, share)
- ✅ Query scoping utilities for SQL-level authorization
- ✅ Guards and decorators (`AbilitiesGuard`, `@CheckAbility()`, `@CurrentUser()`)
- ✅ Middleware for attaching abilities to requests
#### 3. API Endpoints
- ✅ **ShareController** - CRUD for record shares
- POST /shares - Create share
- GET /shares/record/:objectDefinitionId/:recordId - List shares
- GET /shares/granted - Shares granted by user
- GET /shares/received - Shares received by user
- PATCH /shares/:id - Update share
- DELETE /shares/:id - Revoke share
- ✅ **RoleController** - Role management
- Standard CRUD for roles
- RoleRuleController for CASL rules
- ✅ **ObjectAccessController** - Object-level permissions
- GET/PUT /setup/objects/:apiName/access
- POST /setup/objects/:apiName/fields/:fieldKey/permissions
- PUT /setup/objects/:apiName/field-permissions
### Frontend (Nuxt 3 + Vue 3)
#### 4. Object Management Enhancement
- ✅ Added "Access & Permissions" tab to object setup page
- ✅ `ObjectAccessSettings.vue` component:
- Configure access model (public/owner/mixed)
- Set public CRUD permissions
- Configure owner field
- Set field-level read/write permissions
#### 5. Role Management
- ✅ New page: `/setup/roles`
- ✅ `RolePermissionsEditor.vue` component:
- Configure CRUD permissions per object
- Apply conditions (e.g., own records only)
- Visual permission matrix
#### 6. Record Sharing
- ✅ `RecordShareDialog.vue` component:
- List current shares
- Add new shares with permissions
- Field-level scoping
- Expiration dates
- Revoke shares
## Key Features
### 🌍 Global Object Policies
- Public/private access models
- Default CRUD permissions per object
- Configurable owner field
- Field-level default permissions
### 👥 Role-Based Access
- CASL rules stored in database
- Per-object permissions
- Condition-based rules (e.g., ownerId matching)
- Multiple actions per rule
### 🔗 Per-Record Sharing
- Polymorphic design (works with any object type)
- Grant read/update access to specific users
- Optional field-level scoping
- Expiration and revocation support
- Track who granted each share
### 🔒 SQL Query Scoping
- Critical for list endpoints
- Ensures users only see authorized records
- Combines ownership + sharing logic
- Works with public access flags
## File Structure
```
backend/
├── migrations/tenant/
│ └── 20250128000001_add_authorization_system.js
├── src/
│ ├── auth/
│ │ ├── ability.factory.ts (CASL ability builder)
│ │ ├── query-scope.util.ts (SQL scoping utilities)
│ │ ├── guards/
│ │ │ └── abilities.guard.ts
│ │ ├── decorators/
│ │ │ ├── auth.decorators.ts
│ │ │ └── check-ability.decorator.ts
│ │ └── middleware/
│ │ └── ability.middleware.ts
│ ├── models/
│ │ ├── object-field.model.ts
│ │ ├── role-rule.model.ts
│ │ └── record-share.model.ts
│ ├── rbac/
│ │ ├── share.controller.ts
│ │ └── role.controller.ts
│ └── object/
│ └── object-access.controller.ts
frontend/
├── components/
│ ├── ObjectAccessSettings.vue
│ ├── RecordShareDialog.vue
│ └── RolePermissionsEditor.vue
└── pages/
├── setup/
│ ├── objects/[apiName].vue (enhanced with access tab)
│ └── roles.vue
└── ...
docs/
└── AUTHORIZATION_SYSTEM.md (comprehensive documentation)
```
## Next Steps
### 1. Run the Migration
```bash
cd backend
npm run migrate:latest
```
### 2. Initialize Existing Objects
Set default access models for existing object definitions:
```sql
UPDATE object_definitions
SET
access_model = 'owner',
public_read = false,
public_create = false,
public_update = false,
public_delete = false,
owner_field = 'ownerId'
WHERE access_model IS NULL;
```
### 3. Apply Query Scoping
Update existing controllers to use query scoping:
```typescript
import { applyReadScope } from '@/auth/query-scope.util';
// In your list endpoint
async findAll(@CurrentUser() user: User) {
const objectDef = await ObjectDefinition.query(this.knex)
.findOne({ apiName: 'YourObject' });
let query = YourModel.query(this.knex);
query = applyReadScope(query, user, objectDef, this.knex);
return query;
}
```
### 4. Add Route Protection
Use guards on sensitive endpoints:
```typescript
@UseGuards(JwtAuthGuard, AbilitiesGuard)
@CheckAbility({ action: 'update', subject: 'Post' })
async update(@Body() data: any) {
// Only users with 'update' permission on 'Post' can access
}
```
### 5. Frontend Integration
Add sharing button to record detail pages:
```vue
<template>
<div>
<!-- Your record details -->
<Button @click="showShareDialog = true">
<Share class="w-4 h-4 mr-2" />
Share
</Button>
<RecordShareDialog
:open="showShareDialog"
:object-definition-id="objectDefinition.id"
:record-id="record.id"
:fields="objectDefinition.fields"
@close="showShareDialog = false"
/>
</div>
</template>
```
## Testing Checklist
- [ ] Run database migration successfully
- [ ] Create a test role with permissions
- [ ] Configure object access settings via UI
- [ ] Share a record with another user
- [ ] Verify shared record appears in grantee's list
- [ ] Verify query scoping filters unauthorized records
- [ ] Test field-level permissions
- [ ] Test share expiration
- [ ] Test share revocation
- [ ] Test role-based access with conditions
## Performance Considerations
1. **Index Usage**: The migration creates proper indexes on foreign keys and commonly queried columns
2. **Query Scoping**: Uses SQL EXISTS subqueries for efficient filtering
3. **Ability Caching**: Consider caching abilities per request (already done via middleware)
4. **Batch Loading**: When checking multiple records, batch the share lookups
## Security Notes
⚠️ **Important**: Always use SQL query scoping for list endpoints. Never fetch all records and filter in application code.
✅ **Best Practices**:
- Share creation requires ownership verification
- Only grantors can update/revoke shares
- Expired/revoked shares are excluded from queries
- Field-level permissions are enforced on write operations
## Documentation
Full documentation available in:
- [AUTHORIZATION_SYSTEM.md](./AUTHORIZATION_SYSTEM.md) - Comprehensive guide
- Inline code comments in all new files
- JSDoc comments on key functions
## Support
For questions or issues:
1. Check the documentation in `docs/AUTHORIZATION_SYSTEM.md`
2. Review example usage in the controllers
3. Examine the test cases (when added)

101
backend/migrations/tenant/20250128000001_add_authorization_system.js
View File

@@ -1,101 +0,0 @@
/**
* Migration: Add authorization system (CASL + polymorphic sharing)
*
* This migration adds:
* 1. Access control fields to object_definitions
* 2. Field-level permissions to field_definitions
* 3. role_rules table for CASL rules storage
* 4. record_shares table for polymorphic per-record sharing
*/
exports.up = async function(knex) {
// 1. Add access control fields to object_definitions
await knex.schema.table('object_definitions', (table) => {
table.enum('access_model', ['public', 'owner', 'mixed']).defaultTo('owner');
table.boolean('public_read').defaultTo(false);
table.boolean('public_create').defaultTo(false);
table.boolean('public_update').defaultTo(false);
table.boolean('public_delete').defaultTo(false);
table.string('owner_field', 100).defaultTo('ownerId');
});
// 2. Add field-level permission columns to field_definitions
await knex.schema.table('field_definitions', (table) => {
table.boolean('default_readable').defaultTo(true);
table.boolean('default_writable').defaultTo(true);
});
// 3. Create role_rules table for storing CASL rules per role
await knex.schema.createTable('role_rules', (table) => {
table.uuid('id').primary().defaultTo(knex.raw('(UUID())'));
table.uuid('role_id').notNullable();
table.json('rules_json').notNullable(); // Array of CASL rules
table.timestamps(true, true);
// Foreign keys
table.foreign('role_id')
.references('id')
.inTable('roles')
.onDelete('CASCADE');
// Indexes
table.index('role_id');
});
// 4. Create record_shares table for polymorphic per-record sharing
await knex.schema.createTable('record_shares', (table) => {
table.uuid('id').primary().defaultTo(knex.raw('(UUID())'));
table.uuid('object_definition_id').notNullable();
table.string('record_id', 255).notNullable(); // String to support UUID/int uniformly
table.uuid('grantee_user_id').notNullable();
table.uuid('granted_by_user_id').notNullable();
table.json('actions').notNullable(); // Array like ["read"], ["read","update"]
table.json('fields').nullable(); // Optional field scoping
table.timestamp('expires_at').nullable();
table.timestamp('revoked_at').nullable();
table.timestamp('created_at').defaultTo(knex.fn.now());
// Foreign keys
table.foreign('object_definition_id')
.references('id')
.inTable('object_definitions')
.onDelete('CASCADE');
table.foreign('grantee_user_id')
.references('id')
.inTable('users')
.onDelete('CASCADE');
table.foreign('granted_by_user_id')
.references('id')
.inTable('users')
.onDelete('CASCADE');
// Indexes for efficient querying
table.index(['grantee_user_id', 'object_definition_id']);
table.index(['object_definition_id', 'record_id']);
table.unique(['object_definition_id', 'record_id', 'grantee_user_id']);
});
};
exports.down = async function(knex) {
// Drop tables in reverse order
await knex.schema.dropTableIfExists('record_shares');
await knex.schema.dropTableIfExists('role_rules');
// Remove columns from field_definitions
await knex.schema.table('field_definitions', (table) => {
table.dropColumn('default_readable');
table.dropColumn('default_writable');
});
// Remove columns from object_definitions
await knex.schema.table('object_definitions', (table) => {
table.dropColumn('access_model');
table.dropColumn('public_read');
table.dropColumn('public_create');
table.dropColumn('public_update');
table.dropColumn('public_delete');
table.dropColumn('owner_field');
});
};

102
backend/migrations/tenant/20250129000001_add_authorization_system.js Normal file
View File

@@ -0,0 +1,102 @@
exports.up = function (knex) {
return knex.schema
// Add orgWideDefault to object_definitions
.alterTable('object_definitions', (table) => {
table
.enum('orgWideDefault', ['private', 'public_read', 'public_read_write'])
.defaultTo('private')
.notNullable();
})
// Create role_object_permissions table
.createTable('role_object_permissions', (table) => {
table.uuid('id').primary().defaultTo(knex.raw('(UUID())'));
table.uuid('roleId').notNullable();
table.uuid('objectDefinitionId').notNullable();
table.boolean('canCreate').defaultTo(false);
table.boolean('canRead').defaultTo(false);
table.boolean('canEdit').defaultTo(false);
table.boolean('canDelete').defaultTo(false);
table.boolean('canViewAll').defaultTo(false);
table.boolean('canModifyAll').defaultTo(false);
table.timestamps(true, true);
table
.foreign('roleId')
.references('id')
.inTable('roles')
.onDelete('CASCADE');
table
.foreign('objectDefinitionId')
.references('id')
.inTable('object_definitions')
.onDelete('CASCADE');
table.unique(['roleId', 'objectDefinitionId']);
table.index(['roleId']);
table.index(['objectDefinitionId']);
})
// Create role_field_permissions table
.createTable('role_field_permissions', (table) => {
table.uuid('id').primary().defaultTo(knex.raw('(UUID())'));
table.uuid('roleId').notNullable();
table.uuid('fieldDefinitionId').notNullable();
table.boolean('canRead').defaultTo(true);
table.boolean('canEdit').defaultTo(true);
table.timestamps(true, true);
table
.foreign('roleId')
.references('id')
.inTable('roles')
.onDelete('CASCADE');
table
.foreign('fieldDefinitionId')
.references('id')
.inTable('field_definitions')
.onDelete('CASCADE');
table.unique(['roleId', 'fieldDefinitionId']);
table.index(['roleId']);
table.index(['fieldDefinitionId']);
})
// Create record_shares table for sharing specific records
.createTable('record_shares', (table) => {
table.uuid('id').primary().defaultTo(knex.raw('(UUID())'));
table.uuid('objectDefinitionId').notNullable();
table.uuid('recordId').notNullable();
table.uuid('granteeUserId').notNullable();
table.uuid('grantedByUserId').notNullable();
table.json('accessLevel').notNullable(); // { canRead, canEdit, canDelete }
table.timestamp('expiresAt').nullable();
table.timestamp('revokedAt').nullable();
table.timestamp('createdAt').defaultTo(knex.fn.now());
table
.foreign('objectDefinitionId')
.references('id')
.inTable('object_definitions')
.onDelete('CASCADE');
table
.foreign('granteeUserId')
.references('id')
.inTable('users')
.onDelete('CASCADE');
table
.foreign('grantedByUserId')
.references('id')
.inTable('users')
.onDelete('CASCADE');
table.index(['objectDefinitionId', 'recordId']);
table.index(['granteeUserId']);
table.index(['expiresAt']);
table.index(['revokedAt']);
});
};
exports.down = function (knex) {
return knex.schema
.dropTableIfExists('record_shares')
.dropTableIfExists('role_field_permissions')
.dropTableIfExists('role_object_permissions')
.alterTable('object_definitions', (table) => {
table.dropColumn('orgWideDefault');
});
};

67
backend/package-lock.json generated
View File

@@ -26,7 +26,6 @@
"knex": "^3.1.0",
"mysql2": "^3.15.3",
"objection": "^3.1.5",
"objection-authorize": "^5.0.2",
"passport": "^0.7.0",
"passport-jwt": "^4.0.1",
"reflect-metadata": "^0.2.1",
@@ -4335,15 +4334,6 @@
"node": ">=0.10"
}
},
"node_modules/depd": {
"version": "2.0.0",
"resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
"integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
"license": "MIT",
"engines": {
"node": ">= 0.8"
}
},
"node_modules/detect-libc": {
"version": "2.1.2",
"resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
@@ -5758,26 +5748,6 @@
"dev": true,
"license": "MIT"
},
"node_modules/http-errors": {
"version": "2.0.1",
"resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
"integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
"license": "MIT",
"dependencies": {
"depd": "~2.0.0",
"inherits": "~2.0.4",
"setprototypeof": "~1.2.0",
"statuses": "~2.0.2",
"toidentifier": "~1.0.1"
},
"engines": {
"node": ">= 0.8"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/express"
}
},
"node_modules/https-proxy-agent": {
"version": "5.0.1",
"resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
@@ -7941,19 +7911,6 @@
"knex": ">=1.0.1"
}
},
"node_modules/objection-authorize": {
"version": "5.0.2",
"resolved": "https://registry.npmjs.org/objection-authorize/-/objection-authorize-5.0.2.tgz",
"integrity": "sha512-EAZw2lVajv6TXe24W7jzX5X7uSqQcuMA/ssqMzvIDG4CkstGVZJp23PwkjN4+btNjxKjGk4fMfM6yM3HEJekog==",
"license": "LGPL-3.0",
"dependencies": {
"http-errors": "^2.0.0",
"lodash": "^4.17.21"
},
"peerDependencies": {
"objection": "^3"
}
},
"node_modules/objection/node_modules/ajv": {
"version": "8.17.1",
"resolved": "https://registry.npmjs.org/ajv/-/ajv-8.17.1.tgz",
@@ -9121,12 +9078,6 @@
"node": ">= 0.4"
}
},
"node_modules/setprototypeof": {
"version": "1.2.0",
"resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
"integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
"license": "ISC"
},
"node_modules/shebang-command": {
"version": "2.0.0",
"resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
@@ -9274,15 +9225,6 @@
"integrity": "sha512-qoRRSyROncaz1z0mvYqIE4lCd9p2R90i6GxW3uZv5ucSu8tU7B5HXUP1gG8pVZsYNVaXjk8ClXHPttLyxAL48A==",
"license": "MIT"
},
"node_modules/statuses": {
"version": "2.0.2",
"resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
"integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
"license": "MIT",
"engines": {
"node": ">= 0.8"
}
},
"node_modules/string_decoder": {
"version": "1.3.0",
"resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
@@ -9763,15 +9705,6 @@
"node": ">=12"
}
},
"node_modules/toidentifier": {
"version": "1.0.1",
"resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
"integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
"license": "MIT",
"engines": {
"node": ">=0.6"
}
},
"node_modules/token-types": {
"version": "6.1.1",
"resolved": "https://registry.npmjs.org/token-types/-/token-types-6.1.1.tgz",

1
backend/package.json
View File

@@ -43,7 +43,6 @@
"knex": "^3.1.0",
"mysql2": "^3.15.3",
"objection": "^3.1.5",
"objection-authorize": "^5.0.2",
"passport": "^0.7.0",
"passport-jwt": "^4.0.1",
"reflect-metadata": "^0.2.1",

77
backend/prisma/schema.prisma
View File

@@ -24,10 +24,8 @@ model User {
createdAt DateTime @default(now())
updatedAt DateTime @updatedAt
userRoles UserRole[]
accounts Account[]
sharesGranted RecordShare[] @relation("GrantedShares")
sharesReceived RecordShare[] @relation("ReceivedShares")
userRoles UserRole[]
accounts Account[]
@@map("users")
}
@@ -43,7 +41,6 @@ model Role {
userRoles UserRole[]
rolePermissions RolePermission[]
roleRules RoleRule[]
@@unique([name, guardName])
@@map("roles")
@@ -93,42 +90,20 @@ model RolePermission {
@@map("role_permissions")
}
// CASL Rules for Roles
model RoleRule {
id String @id @default(uuid())
roleId String
rulesJson Json @map("rules_json")
createdAt DateTime @default(now())
updatedAt DateTime @updatedAt
role Role @relation(fields: [roleId], references: [id], onDelete: Cascade)
@@index([roleId])
@@map("role_rules")
}
// Object Definition (Metadata)
model ObjectDefinition {
id String @id @default(uuid())
apiName String @unique
label String
pluralLabel String?
description String? @db.Text
isSystem Boolean @default(false)
isCustom Boolean @default(true)
// Authorization fields
accessModel String @default("owner") // 'public' | 'owner' | 'mixed'
publicRead Boolean @default(false)
publicCreate Boolean @default(false)
publicUpdate Boolean @default(false)
publicDelete Boolean @default(false)
ownerField String @default("ownerId")
createdAt DateTime @default(now()) @map("created_at")
updatedAt DateTime @updatedAt @map("updated_at")
id String @id @default(uuid())
apiName String @unique
label String
pluralLabel String?
description String? @db.Text
isSystem Boolean @default(false)
isCustom Boolean @default(true)
createdAt DateTime @default(now()) @map("created_at")
updatedAt DateTime @updatedAt @map("updated_at")
fields FieldDefinition[]
pages AppPage[]
recordShares RecordShare[]
fields FieldDefinition[]
pages AppPage[]
@@map("object_definitions")
}
@@ -151,9 +126,6 @@ model FieldDefinition {
isCustom Boolean @default(true)
displayOrder Int @default(0)
uiMetadata Json? @map("ui_metadata")
// Field-level permissions
defaultReadable Boolean @default(true)
defaultWritable Boolean @default(true)
createdAt DateTime @default(now()) @map("created_at")
updatedAt DateTime @updatedAt @map("updated_at")
@@ -164,29 +136,6 @@ model FieldDefinition {
@@map("field_definitions")
}
// Polymorphic per-record sharing
model RecordShare {
id String @id @default(uuid())
objectDefinitionId String
recordId String
granteeUserId String
grantedByUserId String
actions Json // Array like ["read"], ["read","update"]
fields Json? // Optional field scoping
expiresAt DateTime? @map("expires_at")
revokedAt DateTime? @map("revoked_at")
createdAt DateTime @default(now()) @map("created_at")
objectDefinition ObjectDefinition @relation(fields: [objectDefinitionId], references: [id], onDelete: Cascade)
granteeUser User @relation("ReceivedShares", fields: [granteeUserId], references: [id], onDelete: Cascade)
grantedByUser User @relation("GrantedShares", fields: [grantedByUserId], references: [id], onDelete: Cascade)
@@unique([objectDefinitionId, recordId, granteeUserId])
@@index([granteeUserId, objectDefinitionId])
@@index([objectDefinitionId, recordId])
@@map("record_shares")
}
// Example static object: Account
model Account {
id String @id @default(uuid())

181
backend/scripts/seed-default-roles.ts Normal file
View File

@@ -0,0 +1,181 @@
import { Knex } from 'knex';
import * as knexLib from 'knex';
/**
* Create a Knex connection for tenant database
*/
function createKnexConnection(database: string): Knex {
return knexLib.default({
client: 'mysql2',
connection: {
host: process.env.DB_HOST || 'db',
port: parseInt(process.env.DB_PORT || '3306'),
user: 'root',
password: 'asjdnfqTash37faggT',
database: database,
},
});
}
interface RoleWithPermissions {
name: string;
description: string;
objectPermissions: {
[objectApiName: string]: {
canCreate: boolean;
canRead: boolean;
canEdit: boolean;
canDelete: boolean;
canViewAll: boolean;
canModifyAll: boolean;
};
};
}
const DEFAULT_ROLES: RoleWithPermissions[] = [
{
name: 'System Administrator',
description: 'Full access to all objects and records. Can view and modify all data.',
objectPermissions: {
'*': {
canCreate: true,
canRead: true,
canEdit: true,
canDelete: true,
canViewAll: true,
canModifyAll: true,
},
},
},
{
name: 'Standard User',
description: 'Can create, read, edit, and delete own records. Respects OWD settings.',
objectPermissions: {
'*': {
canCreate: true,
canRead: true,
canEdit: true,
canDelete: true,
canViewAll: false,
canModifyAll: false,
},
},
},
{
name: 'Read Only',
description: 'Can only read records based on OWD settings. No create, edit, or delete.',
objectPermissions: {
'*': {
canCreate: false,
canRead: true,
canEdit: false,
canDelete: false,
canViewAll: false,
canModifyAll: false,
},
},
},
];
async function seedRolesForTenant(knex: Knex, tenantName: string) {
console.log(`\n🌱 Seeding roles for tenant: ${tenantName}`);
// Get all object definitions
const objectDefinitions = await knex('object_definitions').select('id', 'apiName');
for (const roleData of DEFAULT_ROLES) {
// Check if role already exists
const existingRole = await knex('roles')
.where({ name: roleData.name })
.first();
let roleId: string;
if (existingRole) {
console.log(` ℹ️ Role "${roleData.name}" already exists, skipping...`);
roleId = existingRole.id;
} else {
// Create role
await knex('roles').insert({
name: roleData.name,
guardName: 'api',
description: roleData.description,
});
// Get the inserted role
const newRole = await knex('roles')
.where({ name: roleData.name })
.first();
roleId = newRole.id;
console.log(` ✅ Created role: ${roleData.name}`);
}
// Create object permissions for all objects
const wildcardPermissions = roleData.objectPermissions['*'];
for (const objectDef of objectDefinitions) {
// Check if permission already exists
const existingPermission = await knex('role_object_permissions')
.where({
roleId: roleId,
objectDefinitionId: objectDef.id,
})
.first();
if (!existingPermission) {
await knex('role_object_permissions').insert({
roleId: roleId,
objectDefinitionId: objectDef.id,
canCreate: wildcardPermissions.canCreate,
canRead: wildcardPermissions.canRead,
canEdit: wildcardPermissions.canEdit,
canDelete: wildcardPermissions.canDelete,
canViewAll: wildcardPermissions.canViewAll,
canModifyAll: wildcardPermissions.canModifyAll,
});
}
}
console.log(` 📋 Set permissions for ${objectDefinitions.length} objects`);
}
}
async function seedAllTenants() {
console.log('🚀 Starting role seeding for all tenants...\n');
// For now, seed the main tenant database
const databases = ['tenant_tenant1'];
let successCount = 0;
let errorCount = 0;
for (const database of databases) {
try {
const knex = createKnexConnection(database);
await seedRolesForTenant(knex, database);
await knex.destroy();
successCount++;
} catch (error) {
console.error(`❌ ${database}: Seeding failed:`, error.message);
errorCount++;
}
}
console.log('\n============================================================');
console.log('📊 Seeding Summary');
console.log('============================================================');
console.log(`✅ Successful: ${successCount}`);
console.log(`❌ Failed: ${errorCount}`);
if (errorCount === 0) {
console.log('\n🎉 All tenant roles seeded successfully!');
}
}
seedAllTenants()
.then(() => process.exit(0))
.catch((error) => {
console.error('Unhandled error:', error);
process.exit(1);
});

207
backend/src/auth/ability.factory.ts
View File

@@ -1,207 +0,0 @@
import { Injectable } from '@nestjs/common';
import { Ability, AbilityBuilder, AbilityClass, ExtractSubjectType, InferSubjects, createMongoAbility } from '@casl/ability';
import { User } from '../models/user.model';
import { ObjectDefinition } from '../models/object-definition.model';
import { FieldDefinition } from '../models/field-definition.model';
import { RoleRule } from '../models/role-rule.model';
import { RecordShare } from '../models/record-share.model';
import { UserRole } from '../models/user-role.model';
import { Knex } from 'knex';
// Define actions
export type Action = 'read' | 'create' | 'update' | 'delete' | 'share';
// Define subjects - can be string (object type key) or model class
export type Subjects = InferSubjects<any> | 'all';
export type AppAbility = Ability<[Action, Subjects]>;
@Injectable()
export class AbilityFactory {
/**
* Build CASL Ability for a user
* Rules come from 3 layers:
* 1. Global object rules (from object_definitions + object_fields)
* 2. Role rules (from role_rules)
* 3. Share rules (from record_shares for this user)
*/
async buildForUser(user: User, knex: Knex): Promise<AppAbility> {
const { can, cannot, build } = new AbilityBuilder<AppAbility>(
createMongoAbility as any,
);
// 1. Load global object rules
await this.addGlobalRules(user, knex, can, cannot);
// 2. Load role rules
await this.addRoleRules(user, knex, can);
// 3. Load share rules
await this.addShareRules(user, knex, can);
return build({
// Optional: detect subject type from instance
detectSubjectType: (item) => {
if (typeof item === 'string') return item;
return item.constructor?.name || 'unknown';
},
});
}
/**
* Add global rules from object_definitions and object_fields
*/
private async addGlobalRules(
user: User,
knex: Knex,
can: any,
cannot: any,
) {
const objectDefs = await knex<ObjectDefinition>('object_definitions').select('*');
for (const objDef of objectDefs) {
const subject = objDef.apiName;
// Handle public access
if (objDef.publicRead) {
can('read', subject);
}
if (objDef.publicCreate) {
can('create', subject);
}
if (objDef.publicUpdate) {
can('update', subject);
}
if (objDef.publicDelete) {
can('delete', subject);
}
// Handle owner-based access
if (objDef.accessModel === 'owner' || objDef.accessModel === 'mixed') {
const ownerCondition = { [objDef.ownerField]: user.id };
can('read', subject, ownerCondition);
can('update', subject, ownerCondition);
can('delete', subject, ownerCondition);
can('share', subject, ownerCondition); // Owner can share their records
}
// Load field-level permissions for this object
const fields = await knex<FieldDefinition>('field_definitions')
.where('objectDefinitionId', objDef.id)
.select('*');
// Build field lists
const readableFields = fields
.filter((f) => f.defaultReadable)
.map((f) => f.apiName);
const writableFields = fields
.filter((f) => f.defaultWritable)
.map((f) => f.apiName);
// Add field-level rules if we have field restrictions
if (fields.length > 0) {
// For read, limit to readable fields
if (readableFields.length > 0) {
can('read', subject, readableFields);
}
// For update/create, limit to writable fields
if (writableFields.length > 0) {
can(['update', 'create'], subject, writableFields);
}
}
}
}
/**
* Add role-based rules from role_rules
*/
private async addRoleRules(user: User, knex: Knex, can: any) {
// Get user's roles
const userRoles = await knex<UserRole>('user_roles')
.where('userId', user.id)
.select('roleId');
if (userRoles.length === 0) return;
const roleIds = userRoles.map((ur) => ur.roleId);
// Get all role rules for these roles
const roleRules = await knex<RoleRule>('role_rules')
.whereIn('roleId', roleIds)
.select('*');
for (const roleRule of roleRules) {
// Parse and add each rule from the JSON
const rules = roleRule.rulesJson;
if (Array.isArray(rules)) {
rules.forEach((rule) => {
if (rule.inverted) {
// Handle "cannot" rules
// CASL format: { action, subject, conditions?, fields?, inverted: true }
// We'd need to properly parse this - for now, skip inverted rules in factory
} else {
// Handle "can" rules
const { action, subject, conditions, fields } = rule;
if (fields && fields.length > 0) {
can(action, subject, fields, conditions);
} else if (conditions) {
can(action, subject, conditions);
} else {
can(action, subject);
}
}
});
}
}
}
/**
* Add per-record sharing rules from record_shares
*/
private async addShareRules(user: User, knex: Knex, can: any) {
const now = new Date();
// Get all active shares for this user (grantee)
const shares = await knex<RecordShare>('record_shares')
.where('granteeUserId', user.id)
.whereNull('revokedAt')
.where(function () {
this.whereNull('expiresAt').orWhere('expiresAt', '>', now);
})
.select('*');
// Also need to join with object_definitions to get the apiName (subject)
const sharesWithObjects = await knex('record_shares')
.join('object_definitions', 'record_shares.objectDefinitionId', 'object_definitions.id')
.where('record_shares.granteeUserId', user.id)
.whereNull('record_shares.revokedAt')
.where(function () {
this.whereNull('record_shares.expiresAt').orWhere('record_shares.expiresAt', '>', now);
})
.select(
'record_shares.*',
'object_definitions.apiName as objectApiName',
);
for (const share of sharesWithObjects) {
const subject = share.objectApiName;
const actions = Array.isArray(share.actions) ? share.actions : JSON.parse(share.actions);
const fields = share.fields ? (Array.isArray(share.fields) ? share.fields : JSON.parse(share.fields)) : null;
// Create condition: record must match the shared recordId
const condition = { id: share.recordId };
for (const action of actions) {
if (fields && fields.length > 0) {
// Field-scoped share
can(action, subject, fields, condition);
} else {
// Full record share
can(action, subject, condition);
}
}
}
}
}

6
backend/src/auth/auth.module.ts
View File

@@ -6,8 +6,6 @@ import { AuthService } from './auth.service';
import { AuthController } from './auth.controller';
import { JwtStrategy } from './jwt.strategy';
import { TenantModule } from '../tenant/tenant.module';
import { AbilityFactory } from './ability.factory';
import { AbilitiesGuard } from './guards/abilities.guard';
@Module({
imports: [
@@ -21,8 +19,8 @@ import { AbilitiesGuard } from './guards/abilities.guard';
}),
}),
],
providers: [AuthService, JwtStrategy, AbilityFactory, AbilitiesGuard],
providers: [AuthService, JwtStrategy],
controllers: [AuthController],
exports: [AuthService, AbilityFactory, AbilitiesGuard],
exports: [AuthService],
})
export class AuthModule {}

24
backend/src/auth/decorators/auth.decorators.ts
View File

@@ -1,24 +0,0 @@
import { createParamDecorator, ExecutionContext } from '@nestjs/common';
import { AppAbility } from '../ability.factory';
/**
* Decorator to inject the current user's ability into a route handler
* Usage: @CurrentAbility() ability: AppAbility
*/
export const CurrentAbility = createParamDecorator(
(data: unknown, ctx: ExecutionContext): AppAbility => {
const request = ctx.switchToHttp().getRequest();
return request.ability;
},
);
/**
* Decorator to inject the current user into a route handler
* Usage: @CurrentUser() user: User
*/
export const CurrentUser = createParamDecorator(
(data: unknown, ctx: ExecutionContext) => {
const request = ctx.switchToHttp().getRequest();
return request.user;
},
);

10
backend/src/auth/decorators/check-ability.decorator.ts
View File

@@ -1,10 +0,0 @@
import { SetMetadata } from '@nestjs/common';
import { Action } from '../ability.factory';
import { CHECK_ABILITY_KEY, RequiredRule } from '../guards/abilities.guard';
/**
* Decorator to check abilities
* Usage: @CheckAbility({ action: 'read', subject: 'Post' })
*/
export const CheckAbility = (...rules: RequiredRule[]) =>
SetMetadata(CHECK_ABILITY_KEY, rules);

51
backend/src/auth/guards/abilities.guard.ts
View File

@@ -1,51 +0,0 @@
import { Injectable, CanActivate, ExecutionContext, ForbiddenException } from '@nestjs/common';
import { Reflector } from '@nestjs/core';
import { Action, AppAbility } from '../ability.factory';
export interface RequiredRule {
action: Action;
subject: string;
}
/**
* Key for metadata
*/
export const CHECK_ABILITY_KEY = 'check_ability';
/**
* Guard that checks CASL abilities
* Use with @CheckAbility() decorator
*/
@Injectable()
export class AbilitiesGuard implements CanActivate {
constructor(private reflector: Reflector) {}
async canActivate(context: ExecutionContext): Promise<boolean> {
const rules = this.reflector.get<RequiredRule[]>(
CHECK_ABILITY_KEY,
context.getHandler(),
) || [];
if (rules.length === 0) {
return true; // No rules specified, allow
}
const request = context.switchToHttp().getRequest();
const ability: AppAbility = request.ability;
if (!ability) {
throw new ForbiddenException('Ability not found on request');
}
// Check all rules
for (const rule of rules) {
if (!ability.can(rule.action, rule.subject)) {
throw new ForbiddenException(
`You don't have permission to ${rule.action} ${rule.subject}`,
);
}
}
return true;
}
}

24
backend/src/auth/middleware/ability.middleware.ts
View File

@@ -1,24 +0,0 @@
import { Injectable, NestMiddleware, Inject } from '@nestjs/common';
import { Request, Response, NextFunction } from 'express';
import { AbilityFactory } from '../ability.factory';
import { Knex } from 'knex';
/**
* Middleware to build and attach CASL ability to request
* Must run after authentication middleware
*/
@Injectable()
export class AbilityMiddleware implements NestMiddleware {
constructor(
private readonly abilityFactory: AbilityFactory,
@Inject('KnexConnection') private readonly knex: Knex,
) {}
async use(req: Request & { user?: any; ability?: any }, res: Response, next: NextFunction) {
if (req.user) {
// Build ability for authenticated user
req.ability = await this.abilityFactory.buildForUser(req.user, this.knex);
}
next();
}
}

145
backend/src/auth/query-scope.util.ts
View File

@@ -1,145 +0,0 @@
import { QueryBuilder, Model } from 'objection';
import { User } from '../models/user.model';
import { ObjectDefinition } from '../models/object-definition.model';
import { Knex } from 'knex';
/**
* Query scoping utilities for authorization
* Apply SQL-level filtering to ensure users only see records they have access to
*/
export interface AuthScopeOptions {
user: User;
objectDefinition: ObjectDefinition;
action: 'read' | 'update' | 'delete';
knex: Knex;
}
/**
* Apply authorization scope to a query builder
* This implements the SQL equivalent of the CASL ability checks
*
* Rules:
* 1. If object is public_{action} => allow all
* 2. If object is owner/mixed => allow owned OR shared
*/
export function applyAuthScope<M extends Model>(
query: QueryBuilder<M, M[]>,
options: AuthScopeOptions,
): QueryBuilder<M, M[]> {
const { user, objectDefinition, action, knex } = options;
// If public access for this action, no restrictions
if (
(action === 'read' && objectDefinition.publicRead) ||
(action === 'update' && objectDefinition.publicUpdate) ||
(action === 'delete' && objectDefinition.publicDelete)
) {
return query;
}
// Otherwise, apply owner + share logic
const ownerField = objectDefinition.ownerField || 'ownerId';
const tableName = query.modelClass().tableName;
return query.where((builder) => {
// Owner condition
builder.where(`${tableName}.${ownerField}`, user.id);
// OR shared condition
builder.orWhereExists((subquery) => {
subquery
.from('record_shares')
.join('object_definitions', 'record_shares.object_definition_id', 'object_definitions.id')
.whereRaw('record_shares.record_id = ??', [`${tableName}.id`])
.where('record_shares.grantee_user_id', user.id)
.where('object_definitions.id', objectDefinition.id)
.whereNull('record_shares.revoked_at')
.where(function () {
this.whereNull('record_shares.expires_at')
.orWhere('record_shares.expires_at', '>', knex.fn.now());
})
.whereRaw("JSON_CONTAINS(record_shares.actions, ?)", [JSON.stringify(action)]);
});
});
}
/**
* Apply read scope - most common use case
*/
export function applyReadScope<M extends Model>(
query: QueryBuilder<M, M[]>,
user: User,
objectDefinition: ObjectDefinition,
knex: Knex,
): QueryBuilder<M, M[]> {
return applyAuthScope(query, { user, objectDefinition, action: 'read', knex });
}
/**
* Apply update scope
*/
export function applyUpdateScope<M extends Model>(
query: QueryBuilder<M, M[]>,
user: User,
objectDefinition: ObjectDefinition,
knex: Knex,
): QueryBuilder<M, M[]> {
return applyAuthScope(query, { user, objectDefinition, action: 'update', knex });
}
/**
* Apply delete scope
*/
export function applyDeleteScope<M extends Model>(
query: QueryBuilder<M, M[]>,
user: User,
objectDefinition: ObjectDefinition,
knex: Knex,
): QueryBuilder<M, M[]> {
return applyAuthScope(query, { user, objectDefinition, action: 'delete', knex });
}
/**
* Check if user can access a specific record
* This is for single-record operations
*/
export async function canAccessRecord(
recordId: string,
user: User,
objectDefinition: ObjectDefinition,
action: 'read' | 'update' | 'delete',
knex: Knex,
): Promise<boolean> {
// If public access for this action
if (
(action === 'read' && objectDefinition.publicRead) ||
(action === 'update' && objectDefinition.publicUpdate) ||
(action === 'delete' && objectDefinition.publicDelete)
) {
return true;
}
const ownerField = objectDefinition.ownerField || 'ownerId';
// Check if user owns the record (we need the table name, which we can't easily get here)
// This function is meant to be used with a fetched record
// For now, we'll check shares only
// Check if there's a valid share
const now = new Date();
const share = await knex('record_shares')
.where({
objectDefinitionId: objectDefinition.id,
recordId: recordId,
granteeUserId: user.id,
})
.whereNull('revokedAt')
.where(function () {
this.whereNull('expiresAt').orWhere('expiresAt', '>', now);
})
.whereRaw("JSON_CONTAINS(actions, ?)", [JSON.stringify(action)])
.first();
return !!share;
}

2
backend/src/migration/custom-migration.service.ts
View File

@@ -1,5 +1,5 @@
import { Injectable, Logger } from '@nestjs/common';
import type { Knex } from 'knex';
import { Knex } from 'knex';
export interface CustomMigrationRecord {
id: string;

11
backend/src/models/field-definition.model.ts
View File

@@ -64,9 +64,6 @@ export class FieldDefinition extends BaseModel {
isCustom!: boolean;
displayOrder!: number;
uiMetadata?: UIMetadata;
// Field-level permissions
defaultReadable!: boolean;
defaultWritable!: boolean;
static relationMappings = {
objectDefinition: {
@@ -77,5 +74,13 @@ export class FieldDefinition extends BaseModel {
to: 'object_definitions.id',
},
},
rolePermissions: {
relation: BaseModel.HasManyRelation,
modelClass: () => require('./role-field-permission.model').RoleFieldPermission,
join: {
from: 'field_definitions.id',
to: 'role_field_permissions.fieldDefinitionId',
},
},
};
}

25
backend/src/models/object-definition.model.ts
View File

@@ -10,15 +10,11 @@ export class ObjectDefinition extends BaseModel {
description?: string;
isSystem: boolean;
isCustom: boolean;
// Authorization fields
accessModel: 'public' | 'owner' | 'mixed';
publicRead: boolean;
publicCreate: boolean;
publicUpdate: boolean;
publicDelete: boolean;
ownerField: string;
orgWideDefault: 'private' | 'public_read' | 'public_read_write';
createdAt: Date;
updatedAt: Date;
fields?: any[];
rolePermissions?: any[];
static get jsonSchema() {
return {
@@ -32,19 +28,14 @@ export class ObjectDefinition extends BaseModel {
description: { type: 'string' },
isSystem: { type: 'boolean' },
isCustom: { type: 'boolean' },
accessModel: { type: 'string', enum: ['public', 'owner', 'mixed'] },
publicRead: { type: 'boolean' },
publicCreate: { type: 'boolean' },
publicUpdate: { type: 'boolean' },
publicDelete: { type: 'boolean' },
ownerField: { type: 'string' },
orgWideDefault: { type: 'string', enum: ['private', 'public_read', 'public_read_write'] },
},
};
}
static get relationMappings() {
const { FieldDefinition } = require('./field-definition.model');
const { RecordShare } = require('./record-share.model');
const { RoleObjectPermission } = require('./role-object-permission.model');
return {
fields: {
@@ -55,12 +46,12 @@ export class ObjectDefinition extends BaseModel {
to: 'field_definitions.objectDefinitionId',
},
},
recordShares: {
rolePermissions: {
relation: BaseModel.HasManyRelation,
modelClass: RecordShare,
modelClass: RoleObjectPermission,
join: {
from: 'object_definitions.id',
to: 'record_shares.objectDefinitionId',
to: 'role_object_permissions.objectDefinitionId',
},
},
};

36
backend/src/models/record-share.model.ts
View File

@@ -1,5 +1,11 @@
import { BaseModel } from './base.model';
export interface RecordShareAccessLevel {
canRead: boolean;
canEdit: boolean;
canDelete: boolean;
}
export class RecordShare extends BaseModel {
static tableName = 'record_shares';
@@ -8,8 +14,7 @@ export class RecordShare extends BaseModel {
recordId!: string;
granteeUserId!: string;
grantedByUserId!: string;
actions!: any; // JSON field - will be string[] when parsed
fields?: any; // JSON field - will be string[] when parsed
accessLevel!: RecordShareAccessLevel;
expiresAt?: Date;
revokedAt?: Date;
createdAt!: Date;
@@ -17,23 +22,23 @@ export class RecordShare extends BaseModel {
static get jsonSchema() {
return {
type: 'object',
required: ['objectDefinitionId', 'recordId', 'granteeUserId', 'grantedByUserId', 'actions'],
required: ['objectDefinitionId', 'recordId', 'granteeUserId', 'grantedByUserId', 'accessLevel'],
properties: {
id: { type: 'string' },
objectDefinitionId: { type: 'string' },
recordId: { type: 'string' },
granteeUserId: { type: 'string' },
grantedByUserId: { type: 'string' },
actions: {
type: 'array',
items: { type: 'string' },
accessLevel: {
type: 'object',
properties: {
canRead: { type: 'boolean' },
canEdit: { type: 'boolean' },
canDelete: { type: 'boolean' },
},
},
fields: {
type: ['array', 'null'],
items: { type: 'string' },
},
expiresAt: { type: ['string', 'null'], format: 'date-time' },
revokedAt: { type: ['string', 'null'], format: 'date-time' },
expiresAt: { type: 'string', format: 'date-time' },
revokedAt: { type: 'string', format: 'date-time' },
},
};
}
@@ -69,11 +74,4 @@ export class RecordShare extends BaseModel {
},
};
}
// Check if share is currently valid
isValid(): boolean {
if (this.revokedAt) return false;
if (this.expiresAt && new Date(this.expiresAt) < new Date()) return false;
return true;
}
}

51
backend/src/models/role-field-permission.model.ts Normal file
View File

@@ -0,0 +1,51 @@
import { BaseModel } from './base.model';
export class RoleFieldPermission extends BaseModel {
static tableName = 'role_field_permissions';
id!: string;
roleId!: string;
fieldDefinitionId!: string;
canRead!: boolean;
canEdit!: boolean;
createdAt!: Date;
updatedAt!: Date;
static get jsonSchema() {
return {
type: 'object',
required: ['roleId', 'fieldDefinitionId'],
properties: {
id: { type: 'string' },
roleId: { type: 'string' },
fieldDefinitionId: { type: 'string' },
canRead: { type: 'boolean' },
canEdit: { type: 'boolean' },
},
};
}
static get relationMappings() {
const { Role } = require('./role.model');
const { FieldDefinition } = require('./field-definition.model');
return {
role: {
relation: BaseModel.BelongsToOneRelation,
modelClass: Role,
join: {
from: 'role_field_permissions.roleId',
to: 'roles.id',
},
},
fieldDefinition: {
relation: BaseModel.BelongsToOneRelation,
modelClass: FieldDefinition,
join: {
from: 'role_field_permissions.fieldDefinitionId',
to: 'field_definitions.id',
},
},
};
}
}

59
backend/src/models/role-object-permission.model.ts Normal file
View File

@@ -0,0 +1,59 @@
import { BaseModel } from './base.model';
export class RoleObjectPermission extends BaseModel {
static tableName = 'role_object_permissions';
id!: string;
roleId!: string;
objectDefinitionId!: string;
canCreate!: boolean;
canRead!: boolean;
canEdit!: boolean;
canDelete!: boolean;
canViewAll!: boolean;
canModifyAll!: boolean;
createdAt!: Date;
updatedAt!: Date;
static get jsonSchema() {
return {
type: 'object',
required: ['roleId', 'objectDefinitionId'],
properties: {
id: { type: 'string' },
roleId: { type: 'string' },
objectDefinitionId: { type: 'string' },
canCreate: { type: 'boolean' },
canRead: { type: 'boolean' },
canEdit: { type: 'boolean' },
canDelete: { type: 'boolean' },
canViewAll: { type: 'boolean' },
canModifyAll: { type: 'boolean' },
},
};
}
static get relationMappings() {
const { Role } = require('./role.model');
const { ObjectDefinition } = require('./object-definition.model');
return {
role: {
relation: BaseModel.BelongsToOneRelation,
modelClass: Role,
join: {
from: 'role_object_permissions.roleId',
to: 'roles.id',
},
},
objectDefinition: {
relation: BaseModel.BelongsToOneRelation,
modelClass: ObjectDefinition,
join: {
from: 'role_object_permissions.objectDefinitionId',
to: 'object_definitions.id',
},
},
};
}
}

38
backend/src/models/role-rule.model.ts
View File

@@ -1,38 +0,0 @@
import { BaseModel } from './base.model';
export class RoleRule extends BaseModel {
static tableName = 'role_rules';
id: string;
roleId: string;
rulesJson: any[]; // Array of CASL rules
createdAt: Date;
updatedAt: Date;
static get jsonSchema() {
return {
type: 'object',
required: ['roleId', 'rulesJson'],
properties: {
id: { type: 'string' },
roleId: { type: 'string' },
rulesJson: { type: 'array' },
},
};
}
static get relationMappings() {
const { Role } = require('./role.model');
return {
role: {
relation: BaseModel.BelongsToOneRelation,
modelClass: Role,
join: {
from: 'role_rules.roleId',
to: 'roles.id',
},
},
};
}
}

17
backend/src/models/role.model.ts
View File

@@ -27,7 +27,8 @@ export class Role extends BaseModel {
const { RolePermission } = require('./role-permission.model');
const { Permission } = require('./permission.model');
const { User } = require('./user.model');
const { RoleRule } = require('./role-rule.model');
const { RoleObjectPermission } = require('./role-object-permission.model');
const { RoleFieldPermission } = require('./role-field-permission.model');
return {
rolePermissions: {
@@ -62,12 +63,20 @@ export class Role extends BaseModel {
to: 'users.id',
},
},
roleRules: {
objectPermissions: {
relation: BaseModel.HasManyRelation,
modelClass: RoleRule,
modelClass: RoleObjectPermission,
join: {
from: 'roles.id',
to: 'role_rules.roleId',
to: 'role_object_permissions.roleId',
},
},
fieldPermissions: {
relation: BaseModel.HasManyRelation,
modelClass: RoleFieldPermission,
join: {
from: 'roles.id',
to: 'role_field_permissions.roleId',
},
},
};

17
backend/src/models/user.model.ts
View File

@@ -30,7 +30,6 @@ export class User extends BaseModel {
static get relationMappings() {
const { UserRole } = require('./user-role.model');
const { Role } = require('./role.model');
const { RecordShare } = require('./record-share.model');
return {
userRoles: {
@@ -53,22 +52,6 @@ export class User extends BaseModel {
to: 'roles.id',
},
},
sharesGranted: {
relation: BaseModel.HasManyRelation,
modelClass: RecordShare,
join: {
from: 'users.id',
to: 'record_shares.grantedByUserId',
},
},
sharesReceived: {
relation: BaseModel.HasManyRelation,
modelClass: RecordShare,
join: {
from: 'users.id',
to: 'record_shares.granteeUserId',
},
},
};
}
}

32
backend/src/object/models/base.model.ts
View File

@@ -1,4 +1,5 @@
import { Model } from 'objection';
import { randomUUID } from 'crypto';
/**
* Base model for all dynamic and system models
@@ -10,26 +11,23 @@ export class BaseModel extends Model {
tenantId?: string;
ownerId?: string;
name?: string;
created_at?: Date;
updated_at?: Date;
created_at?: string;
updated_at?: string;
// Hook to set system-managed fields
$beforeInsert() {
// created_at and updated_at are handled by the database
// ownerId should be set by the controller/service
async $beforeInsert() {
if (!this.id) {
this.id = randomUUID();
}
if (!this.created_at) {
this.created_at = new Date().toISOString().slice(0, 19).replace('T', ' ');
}
if (!this.updated_at) {
this.updated_at = new Date().toISOString().slice(0, 19).replace('T', ' ');
}
}
$beforeUpdate() {
// updated_at is handled by the database
}
/**
* Get the API name for this object
* Override in subclasses
*/
static get objectApiName(): string {
return 'BaseModel';
async $beforeUpdate() {
this.updated_at = new Date().toISOString().slice(0, 19).replace('T', ' ');
}
}

42
backend/src/object/models/dynamic-model.factory.ts
View File

@@ -1,4 +1,3 @@
import { randomUUID } from 'crypto';
import { ModelClass, JSONSchema, RelationMappings, Model } from 'objection';
import { BaseModel } from './base.model';
@@ -28,6 +27,14 @@ export interface ObjectMetadata {
}
export class DynamicModelFactory {
/**
* Get relation name from lookup field API name
* Converts "ownerId" -> "owner", "customFieldId" -> "customfield"
*/
static getRelationName(lookupFieldApiName: string): string {
return lookupFieldApiName.replace(/Id$/, '').toLowerCase();
}
/**
* Create a dynamic model class from object metadata
* @param meta Object metadata
@@ -49,8 +56,7 @@ export class DynamicModelFactory {
updated_at: { type: 'string', format: 'date-time' },
};
// Don't require system-managed fields (id, tenantId, ownerId, timestamps)
// These are auto-set by hooks or database
// Don't require id or tenantId - they'll be set automatically
const required: string[] = [];
// Add custom fields
@@ -70,20 +76,13 @@ export class DynamicModelFactory {
// Store lookup fields metadata for later use
const lookupFieldsInfo = lookupFields.map(f => ({
apiName: f.apiName,
relationName: f.apiName.replace(/Id$/, '').toLowerCase(),
relationName: DynamicModelFactory.getRelationName(f.apiName),
referenceObject: f.referenceObject,
targetTable: this.getTableName(f.referenceObject),
}));
// Create the dynamic model class extending Model directly
class DynamicModel extends Model {
id?: string;
tenantId?: string;
ownerId?: string;
name?: string;
created_at?: string;
updated_at?: string;
// Create the dynamic model class extending BaseModel
class DynamicModel extends BaseModel {
static tableName = tableName;
static objectApiName = apiName;
@@ -130,23 +129,6 @@ export class DynamicModelFactory {
properties,
};
}
async $beforeInsert() {
if (!this.id) {
this.id = randomUUID();
}
if (!this.created_at) {
this.created_at = new Date().toISOString().slice(0, 19).replace('T', ' ');
}
if (!this.updated_at) {
this.updated_at = new Date().toISOString().slice(0, 19).replace('T', ' ');
}
}
async $beforeUpdate(opt: any, queryContext: any) {
await super.$beforeUpdate(opt, queryContext);
this.updated_at = new Date().toISOString().slice(0, 19).replace('T', ' ');
}
}
return DynamicModel as any;

2
backend/src/object/models/model.service.ts
View File

@@ -1,5 +1,5 @@
import { Injectable, Logger } from '@nestjs/common';
import type { Knex } from 'knex';
import { Knex } from 'knex';
import { ModelClass } from 'objection';
import { BaseModel } from './base.model';
import { ModelRegistry } from './model.registry';

3
backend/src/object/object.module.ts
View File

@@ -6,11 +6,12 @@ import { SchemaManagementService } from './schema-management.service';
import { FieldMapperService } from './field-mapper.service';
import { TenantModule } from '../tenant/tenant.module';
import { MigrationModule } from '../migration/migration.module';
import { RbacModule } from '../rbac/rbac.module';
import { ModelRegistry } from './models/model.registry';
import { ModelService } from './models/model.service';
@Module({
imports: [TenantModule, MigrationModule],
imports: [TenantModule, MigrationModule, RbacModule],
providers: [
ObjectService,
SchemaManagementService,

741
backend/src/object/object.service.ts
View File

@@ -1,11 +1,12 @@
import { Injectable, NotFoundException, ForbiddenException, Logger } from '@nestjs/common';
import { Injectable, NotFoundException, Logger } from '@nestjs/common';
import { TenantDatabaseService } from '../tenant/tenant-database.service';
import { CustomMigrationService } from '../migration/custom-migration.service';
import { ModelService } from './models/model.service';
import { ObjectMetadata } from './models/dynamic-model.factory';
import { applyReadScope, applyUpdateScope, applyDeleteScope } from '../auth/query-scope.util';
import { User } from '../models/user.model';
import { AuthorizationService } from '../rbac/authorization.service';
import { ObjectDefinition } from '../models/object-definition.model';
import { FieldDefinition } from '../models/field-definition.model';
import { User } from '../models/user.model';
import { ObjectMetadata } from './models/dynamic-model.factory';
@Injectable()
export class ObjectService {
@@ -15,6 +16,7 @@ export class ObjectService {
private tenantDbService: TenantDatabaseService,
private customMigrationService: CustomMigrationService,
private modelService: ModelService,
private authService: AuthorizationService,
) {}
// Setup endpoints - Object metadata management
@@ -228,6 +230,31 @@ export class ObjectService {
return objectDef;
}
async updateObjectDefinition(
tenantId: string,
objectApiName: string,
data: Partial<{
label: string;
pluralLabel: string;
description: string;
orgWideDefault: 'private' | 'public_read' | 'public_read_write';
}>,
) {
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
// Update the object definition
await ObjectDefinition.query(knex)
.findOne({ apiName: objectApiName })
.patch({
...data,
updatedAt: new Date(),
});
// Return updated object
return await ObjectDefinition.query(knex)
.findOne({ apiName: objectApiName });
}
async createFieldDefinition(
tenantId: string,
@@ -350,55 +377,6 @@ export class ObjectService {
return typeMap[frontendType] || 'TEXT';
}
/**
* Filter incoming data to only include writable fields based on field definitions
* Removes system fields and fields that don't exist in the schema
*/
private async filterWritableFields(
tenantId: string,
objectApiName: string,
data: any,
isUpdate: boolean = false,
): Promise<any> {
const objectDef = await this.getObjectDefinition(tenantId, objectApiName);
const filtered: any = {};
for (const [key, value] of Object.entries(data)) {
// Find the field definition
const fieldDef = objectDef.fields.find((f: any) => f.apiName === key);
if (!fieldDef) {
// Field doesn't exist in schema, skip it
this.logger.warn(`Field ${key} not found in ${objectApiName} schema, skipping`);
continue;
}
// Skip system fields
if (fieldDef.isSystem) {
this.logger.debug(`Skipping system field ${key}`);
continue;
}
// Check if field is writable (for authorization)
// Support both snake_case (from DB) and camelCase (if mapped)
const defaultWritable = fieldDef.default_writable ?? fieldDef.defaultWritable;
if (defaultWritable === false || defaultWritable === 0) {
this.logger.warn(`Field ${key} is not writable (default_writable = ${defaultWritable}), skipping`);
continue;
}
// For update operations, also skip ID field
if (isUpdate && key === 'id') {
continue;
}
// Field is valid and writable, include it
filtered[key] = value;
}
return filtered;
}
/**
* Ensure a model is registered for the given object.
* Delegates to ModelService which handles creating the model and all its dependencies.
@@ -470,74 +448,57 @@ export class ObjectService {
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
// Verify object exists and get field definitions
const objectDef = await this.getObjectDefinition(tenantId, objectApiName);
// Get object definition with authorization settings
const objectDefModel = await ObjectDefinition.query(knex)
.findOne({ apiName: objectApiName });
if (!objectDefModel) {
throw new NotFoundException('Object definition not found');
}
// Get user model for authorization
const user = await User.query(knex).findById(userId).withGraphFetched('roles');
// Get user with roles and permissions
const user = await User.query(knex)
.findById(userId)
.withGraphFetched('[roles.[objectPermissions, fieldPermissions]]');
if (!user) {
throw new NotFoundException('User not found');
}
// Get object definition with authorization settings
const objectDefModel = await ObjectDefinition.query(knex)
.findOne({ apiName: objectApiName })
.withGraphFetched('fields');
if (!objectDefModel) {
throw new NotFoundException(`Object ${objectApiName} not found`);
}
const tableName = this.getTableName(objectApiName);
// Ensure model is registered before attempting to use it
// Ensure model is registered
await this.ensureModelRegistered(resolvedTenantId, objectApiName);
// Try to use the Objection model if available
try {
const Model = this.modelService.getModel(resolvedTenantId, objectApiName);
if (Model) {
const boundModel = await this.modelService.getBoundModel(resolvedTenantId, objectApiName);
let query = boundModel.query();
// Apply authorization scoping
query = applyReadScope(query, user, objectDefModel, knex);
// Build graph expression for lookup fields
const lookupFields = objectDef.fields?.filter(f =>
f.type === 'LOOKUP' && f.referenceObject
) || [];
if (lookupFields.length > 0) {
// Build relation expression - use singular lowercase for relation name
const relationExpression = lookupFields
.map(f => f.apiName.replace(/Id$/, '').toLowerCase())
.filter(Boolean)
.join(', ');
if (relationExpression) {
query = query.withGraphFetched(`[${relationExpression}]`);
}
}
// Apply additional filters
if (filters) {
query = query.where(filters);
}
return query.select('*');
}
} catch (error) {
this.logger.warn(`Could not use Objection model for ${objectApiName}, falling back to manual join: ${error.message}`);
}
// Fallback to manual data hydration - Note: This path doesn't support authorization scoping yet
let query = knex(tableName);
// Use Objection model
const boundModel = await this.modelService.getBoundModel(resolvedTenantId, objectApiName);
let query = boundModel.query();
// Add ownership filter if ownerId field exists (basic fallback)
const hasOwner = await knex.schema.hasColumn(tableName, 'ownerId');
if (hasOwner) {
query = query.where({ [`${tableName}.ownerId`]: userId });
// Apply authorization scope (modifies query in place)
await this.authService.applyScopeToQuery(
query,
objectDefModel,
user,
'read',
knex,
);
// Build graph expression for lookup fields
const lookupFields = objectDefModel.fields?.filter(f =>
f.type === 'LOOKUP' && f.referenceObject
) || [];
if (lookupFields.length > 0) {
// Build relation expression - use singular lowercase for relation name
const relationExpression = lookupFields
.map(f => f.apiName.replace(/Id$/, '').toLowerCase())
.filter(Boolean)
.join(', ');
if (relationExpression) {
query = query.withGraphFetched(`[${relationExpression}]`);
}
}
// Apply additional filters
@@ -545,49 +506,16 @@ export class ObjectService {
query = query.where(filters);
}
// Get base records
const records = await query.select(`${tableName}.*`);
const records = await query.select('*');
// Fetch and attach related records for lookup fields
const lookupFields = objectDef.fields?.filter(f =>
f.type === 'LOOKUP' && f.referenceObject
) || [];
// Filter fields based on field-level permissions
const filteredRecords = await Promise.all(
records.map(record =>
this.authService.filterReadableFields(record, objectDefModel.fields, user)
)
);
if (lookupFields.length > 0 && records.length > 0) {
for (const field of lookupFields) {
const relationName = field.apiName.replace(/Id$/, '').toLowerCase();
const relatedTable = this.getTableName(field.referenceObject);
// Get unique IDs to fetch
const relatedIds = [...new Set(
records
.map(r => r[field.apiName])
.filter(Boolean)
)];
if (relatedIds.length > 0) {
// Fetch all related records in one query
const relatedRecords = await knex(relatedTable)
.whereIn('id', relatedIds)
.select('*');
// Create a map for quick lookup
const relatedMap = new Map(
relatedRecords.map(r => [r.id, r])
);
// Attach related records to main records
for (const record of records) {
const relatedId = record[field.apiName];
if (relatedId && relatedMap.has(relatedId)) {
record[relationName] = relatedMap.get(relatedId);
}
}
}
}
}
return records;
return filteredRecords;
}
async getRecord(
@@ -599,106 +527,66 @@ export class ObjectService {
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
// Verify object exists and get field definitions
const objectDef = await this.getObjectDefinition(tenantId, objectApiName);
// Get object definition with authorization settings
const objectDefModel = await ObjectDefinition.query(knex)
.findOne({ apiName: objectApiName });
if (!objectDefModel) {
throw new NotFoundException('Object definition not found');
}
// Get user model for authorization
const user = await User.query(knex).findById(userId).withGraphFetched('roles');
// Get user with roles and permissions
const user = await User.query(knex)
.findById(userId)
.withGraphFetched('[roles.[objectPermissions, fieldPermissions]]');
if (!user) {
throw new NotFoundException('User not found');
}
const tableName = this.getTableName(objectApiName);
// Get object definition with authorization settings
const objectDefModel = await ObjectDefinition.query(knex)
.findOne({ apiName: objectApiName })
.withGraphFetched('fields');
// Ensure model is registered before attempting to use it
if (!objectDefModel) {
throw new NotFoundException(`Object ${objectApiName} not found`);
}
// Ensure model is registered
await this.ensureModelRegistered(resolvedTenantId, objectApiName);
// Try to use the Objection model if available
try {
const Model = this.modelService.getModel(resolvedTenantId, objectApiName);
if (Model) {
const boundModel = await this.modelService.getBoundModel(resolvedTenantId, objectApiName);
let query = boundModel.query().where({ id: recordId });
// Apply authorization scoping
query = applyReadScope(query, user, objectDefModel, knex);
// Build graph expression for lookup fields
const lookupFields = objectDef.fields?.filter(f =>
f.type === 'LOOKUP' && f.referenceObject
) || [];
if (lookupFields.length > 0) {
// Build relation expression - use singular lowercase for relation name
const relationExpression = lookupFields
.map(f => f.apiName.replace(/Id$/, '').toLowerCase())
.filter(Boolean)
.join(', ');
if (relationExpression) {
query = query.withGraphFetched(`[${relationExpression}]`);
}
}
const record = await query.first();
if (!record) {
throw new NotFoundException('Record not found or you do not have access');
}
return record;
}
} catch (error) {
this.logger.warn(`Could not use Objection model for ${objectApiName}, falling back to manual join: ${error.message}`);
}
// Fallback to manual data hydration - Note: This path doesn't support authorization scoping yet
let query = knex(tableName).where({ [`${tableName}.id`]: recordId });
// Use Objection model
const boundModel = await this.modelService.getBoundModel(resolvedTenantId, objectApiName);
let query = boundModel.query().where({ id: recordId });
// Add ownership filter if ownerId field exists (basic fallback)
const hasOwner = await knex.schema.hasColumn(tableName, 'ownerId');
if (hasOwner) {
query = query.where({ [`${tableName}.ownerId`]: userId });
}
// Apply authorization scope (modifies query in place)
await this.authService.applyScopeToQuery(
query,
objectDefModel,
user,
'read',
knex,
);
const record = await query.first();
if (!record) {
throw new NotFoundException('Record not found or you do not have access');
}
// Fetch and attach related records for lookup fields
const lookupFields = objectDef.fields?.filter(f =>
// Build graph expression for lookup fields
const lookupFields = objectDefModel.fields?.filter(f =>
f.type === 'LOOKUP' && f.referenceObject
) || [];
if (lookupFields.length > 0) {
for (const field of lookupFields) {
const relationName = field.apiName.replace(/Id$/, '').toLowerCase();
const relatedTable = this.getTableName(field.referenceObject);
const relatedId = record[field.apiName];
if (relatedId) {
// Fetch the related record
const relatedRecord = await knex(relatedTable)
.where({ id: relatedId })
.first();
if (relatedRecord) {
record[relationName] = relatedRecord;
}
}
// Build relation expression - use singular lowercase for relation name
const relationExpression = lookupFields
.map(f => f.apiName.replace(/Id$/, '').toLowerCase())
.filter(Boolean)
.join(', ');
if (relationExpression) {
query = query.withGraphFetched(`[${relationExpression}]`);
}
}
return record;
const record = await query.first();
if (!record) {
throw new NotFoundException('Record not found');
}
// Filter fields based on field-level permissions
const filteredRecord = await this.authService.filterReadableFields(record, objectDefModel.fields, user);
return filteredRecord;
}
async createRecord(
@@ -710,73 +598,44 @@ export class ObjectService {
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
// Verify object exists
await this.getObjectDefinition(tenantId, objectApiName);
// Get user with roles and permissions
const user = await User.query(knex)
.findById(userId)
.withGraphFetched('[roles.[objectPermissions, fieldPermissions]]');
if (!user) {
throw new NotFoundException('User not found');
}
// Get object definition with authorization settings
const objectDefModel = await ObjectDefinition.query(knex)
.findOne({ apiName: objectApiName });
.findOne({ apiName: objectApiName })
.withGraphFetched('fields');
if (!objectDefModel) {
throw new NotFoundException('Object definition not found');
throw new NotFoundException(`Object ${objectApiName} not found`);
}
// Check create permission
if (!objectDefModel.publicCreate) {
// Get user with roles to check role-based permissions
const user = await User.query(knex).findById(userId).withGraphFetched('roles');
if (!user) {
throw new NotFoundException('User not found');
}
// TODO: Check role-based create permissions from role_rules
// For now, only allow if publicCreate is true
throw new ForbiddenException('You do not have permission to create records for this object');
// Check if user has create permission
const canCreate = await this.authService.canCreate(objectDefModel, user);
if (!canCreate) {
throw new NotFoundException('You do not have permission to create records of this object');
}
// Filter data to only include writable fields based on field definitions
// Do this BEFORE model registration so both Objection and fallback paths use clean data
const allowedData = await this.filterWritableFields(tenantId, objectApiName, data, false);
// Filter data to only editable fields
const editableData = await this.authService.filterEditableFields(data, objectDefModel.fields, user);
// Ensure model is registered before attempting to use it
// Ensure model is registered
await this.ensureModelRegistered(resolvedTenantId, objectApiName);
// Try to use the Objection model if available
try {
const Model = this.modelService.getModel(resolvedTenantId, objectApiName);
if (Model) {
const boundModel = await this.modelService.getBoundModel(resolvedTenantId, objectApiName);
const recordData = {
...allowedData,
ownerId: userId, // Auto-set owner
};
const record = await boundModel.query().insert(recordData);
return record;
}
} catch (error) {
console.warn(`Could not use Objection model for ${objectApiName}:`, error.message);
}
// Fallback to raw Knex if model not available
const tableName = this.getTableName(objectApiName);
const hasOwner = await knex.schema.hasColumn(tableName, 'ownerId');
const recordData: any = {
id: knex.raw('(UUID())'),
...allowedData, // Use filtered data instead of raw data
created_at: knex.fn.now(),
updated_at: knex.fn.now(),
// Use Objection model
const boundModel = await this.modelService.getBoundModel(resolvedTenantId, objectApiName);
const recordData = {
...editableData,
ownerId: userId, // Auto-set owner
};
if (hasOwner) {
recordData.ownerId = userId;
}
const [id] = await knex(tableName).insert(recordData);
return knex(tableName).where({ id }).first();
const record = await boundModel.query().insert(recordData);
return record;
}
async updateRecord(
@@ -789,67 +648,51 @@ export class ObjectService {
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
// Get object definition with authorization settings
const objectDefModel = await ObjectDefinition.query(knex)
.findOne({ apiName: objectApiName });
if (!objectDefModel) {
throw new NotFoundException('Object definition not found');
}
// Get user model for authorization
const user = await User.query(knex).findById(userId).withGraphFetched('roles');
// Get user with roles and permissions
const user = await User.query(knex)
.findById(userId)
.withGraphFetched('[roles.[objectPermissions, fieldPermissions]]');
if (!user) {
throw new NotFoundException('User not found');
}
// Filter data to only include writable fields based on field definitions
// Do this BEFORE authorization checks so both paths use clean data
const allowedData = await this.filterWritableFields(tenantId, objectApiName, data, true);
// Get object definition with authorization settings
const objectDefModel = await ObjectDefinition.query(knex)
.findOne({ apiName: objectApiName })
.withGraphFetched('fields');
if (!objectDefModel) {
throw new NotFoundException(`Object ${objectApiName} not found`);
}
// Verify user has access to read the record first (using authorization scope)
const tableName = this.getTableName(objectApiName);
// Get existing record
const existingRecord = await knex(tableName).where({ id: recordId }).first();
if (!existingRecord) {
throw new NotFoundException('Record not found');
}
// Check if user can update this record
await this.authService.assertCanPerformAction('update', objectDefModel, existingRecord, user, knex);
// Filter data to only editable fields
const editableData = await this.authService.filterEditableFields(data, objectDefModel.fields, user);
// Remove system fields
delete editableData.id;
delete editableData.ownerId;
delete editableData.created_at;
delete editableData.tenantId;
// Ensure model is registered
await this.ensureModelRegistered(resolvedTenantId, objectApiName);
const Model = this.modelService.getModel(resolvedTenantId, objectApiName);
if (Model) {
const boundModel = await this.modelService.getBoundModel(resolvedTenantId, objectApiName);
let checkQuery = boundModel.query().where({ id: recordId });
checkQuery = applyUpdateScope(checkQuery, user, objectDefModel, knex);
const existingRecord = await checkQuery.first();
if (!existingRecord) {
throw new ForbiddenException('You do not have permission to update this record');
}
this.logger.log(`[UPDATE] Record ID: ${recordId}, Type: ${typeof recordId}`);
this.logger.log(`[UPDATE] Existing record ID: ${existingRecord.id}, Type: ${typeof existingRecord.id}`);
this.logger.log(`[UPDATE] Allowed data:`, JSON.stringify(allowedData));
const numUpdated = await boundModel.query().where({ id: recordId }).update(allowedData);
this.logger.log(`[UPDATE] Number of records updated: ${numUpdated}`);
const updatedRecord = await boundModel.query().where({ id: recordId }).first();
this.logger.log(`[UPDATE] Updated record:`, updatedRecord ? 'found' : 'NOT FOUND');
return updatedRecord;
}
// Fallback to raw Knex with basic ownership check
const hasOwner = await knex.schema.hasColumn(tableName, 'ownerId');
if (hasOwner && !objectDefModel.publicUpdate) {
const record = await knex(tableName).where({ id: recordId, ownerId: userId }).first();
if (!record) {
throw new ForbiddenException('You do not have permission to update this record');
}
}
await knex(tableName)
.where({ id: recordId })
.update({ ...allowedData, updated_at: knex.fn.now() }); // Use filtered data
return knex(tableName).where({ id: recordId }).first();
// Use Objection model
const boundModel = await this.modelService.getBoundModel(resolvedTenantId, objectApiName);
await boundModel.query().where({ id: recordId }).update(editableData);
return boundModel.query().where({ id: recordId }).first();
}
async deleteRecord(
@@ -861,52 +704,198 @@ export class ObjectService {
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
// Get object definition with authorization settings
const objectDefModel = await ObjectDefinition.query(knex)
.findOne({ apiName: objectApiName });
if (!objectDefModel) {
throw new NotFoundException('Object definition not found');
}
// Get user model for authorization
const user = await User.query(knex).findById(userId).withGraphFetched('roles');
// Get user with roles and permissions
const user = await User.query(knex)
.findById(userId)
.withGraphFetched('[roles.[objectPermissions, fieldPermissions]]');
if (!user) {
throw new NotFoundException('User not found');
}
// Get object definition with authorization settings
const objectDefModel = await ObjectDefinition.query(knex)
.findOne({ apiName: objectApiName });
if (!objectDefModel) {
throw new NotFoundException(`Object ${objectApiName} not found`);
}
const tableName = this.getTableName(objectApiName);
// Get existing record
const existingRecord = await knex(tableName).where({ id: recordId }).first();
if (!existingRecord) {
throw new NotFoundException('Record not found');
}
// Check if user can delete this record
await this.authService.assertCanPerformAction('delete', objectDefModel, existingRecord, user, knex);
// Ensure model is registered
await this.ensureModelRegistered(resolvedTenantId, objectApiName);
// Try to use the Objection model if available
const Model = this.modelService.getModel(resolvedTenantId, objectApiName);
if (Model) {
const boundModel = await this.modelService.getBoundModel(resolvedTenantId, objectApiName);
// Check if user has permission to delete this record
let checkQuery = boundModel.query().where({ id: recordId });
checkQuery = applyDeleteScope(checkQuery, user, objectDefModel, knex);
const existingRecord = await checkQuery.first();
if (!existingRecord) {
throw new ForbiddenException('You do not have permission to delete this record');
}
await boundModel.query().where({ id: recordId }).delete();
return { success: true };
// Use Objection model
const boundModel = await this.modelService.getBoundModel(resolvedTenantId, objectApiName);
await boundModel.query().where({ id: recordId }).delete();
return { success: true };
}
async getFieldPermissions(tenantId: string, objectId: string) {
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
// Get all field permissions for this object's fields
const permissions = await knex('role_field_permissions as rfp')
.join('field_definitions as fd', 'fd.id', 'rfp.fieldDefinitionId')
.where('fd.objectDefinitionId', objectId)
.select('rfp.*');
return permissions;
}
async updateFieldPermission(
tenantId: string,
roleId: string,
fieldDefinitionId: string,
canRead: boolean,
canEdit: boolean,
) {
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
// Check if permission already exists
const existing = await knex('role_field_permissions')
.where({ roleId, fieldDefinitionId })
.first();
if (existing) {
// Update existing permission
await knex('role_field_permissions')
.where({ roleId, fieldDefinitionId })
.update({
canRead,
canEdit,
updated_at: knex.fn.now(),
});
} else {
// Create new permission
await knex('role_field_permissions').insert({
id: knex.raw('(UUID())'),
roleId,
fieldDefinitionId,
canRead,
canEdit,
created_at: knex.fn.now(),
updated_at: knex.fn.now(),
});
}
// Fallback to raw Knex with basic ownership check
const hasOwner = await knex.schema.hasColumn(tableName, 'ownerId');
if (hasOwner && !objectDefModel.publicDelete) {
const record = await knex(tableName).where({ id: recordId, ownerId: userId }).first();
if (!record) {
throw new ForbiddenException('You do not have permission to delete this record');
}
return { success: true };
}
async getObjectPermissions(
tenantId: string,
objectApiName: string,
roleId: string,
) {
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
// Get object definition
const objectDef = await ObjectDefinition.query(knex)
.findOne({ apiName: objectApiName });
if (!objectDef) {
throw new NotFoundException(`Object ${objectApiName} not found`);
}
await knex(tableName).where({ id: recordId }).delete();
// Get role object permissions
const permission = await knex('role_object_permissions')
.where({ roleId, objectDefinitionId: objectDef.id })
.first();
if (!permission) {
// Return default permissions (all false)
return {
canCreate: false,
canRead: false,
canEdit: false,
canDelete: false,
canViewAll: false,
canModifyAll: false,
};
}
return {
canCreate: Boolean(permission.canCreate),
canRead: Boolean(permission.canRead),
canEdit: Boolean(permission.canEdit),
canDelete: Boolean(permission.canDelete),
canViewAll: Boolean(permission.canViewAll),
canModifyAll: Boolean(permission.canModifyAll),
};
}
async updateObjectPermissions(
tenantId: string,
objectApiName: string,
data: {
roleId: string;
canCreate: boolean;
canRead: boolean;
canEdit: boolean;
canDelete: boolean;
canViewAll: boolean;
canModifyAll: boolean;
},
) {
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
// Get object definition
const objectDef = await ObjectDefinition.query(knex)
.findOne({ apiName: objectApiName });
if (!objectDef) {
throw new NotFoundException(`Object ${objectApiName} not found`);
}
// Check if permission already exists
const existing = await knex('role_object_permissions')
.where({ roleId: data.roleId, objectDefinitionId: objectDef.id })
.first();
if (existing) {
// Update existing permission
await knex('role_object_permissions')
.where({ roleId: data.roleId, objectDefinitionId: objectDef.id })
.update({
canCreate: data.canCreate,
canRead: data.canRead,
canEdit: data.canEdit,
canDelete: data.canDelete,
canViewAll: data.canViewAll,
canModifyAll: data.canModifyAll,
updated_at: knex.fn.now(),
});
} else {
// Create new permission
await knex('role_object_permissions').insert({
id: knex.raw('(UUID())'),
roleId: data.roleId,
objectDefinitionId: objectDef.id,
canCreate: data.canCreate,
canRead: data.canRead,
canEdit: data.canEdit,
canDelete: data.canDelete,
canViewAll: data.canViewAll,
canModifyAll: data.canModifyAll,
created_at: knex.fn.now(),
updated_at: knex.fn.now(),
});
}
return { success: true };
}

2
backend/src/object/schema-management.service.ts
View File

@@ -1,5 +1,5 @@
import { Injectable, Logger } from '@nestjs/common';
import type { Knex } from 'knex';
import { Knex } from 'knex';
import { ObjectDefinition } from '../models/object-definition.model';
import { FieldDefinition } from '../models/field-definition.model';

140
backend/src/object/setup-object.controller.ts
View File

@@ -2,19 +2,17 @@ import {
Controller,
Get,
Post,
Patch,
Put,
Param,
Body,
UseGuards,
Inject,
} from '@nestjs/common';
import { ObjectService } from './object.service';
import { FieldMapperService } from './field-mapper.service';
import { JwtAuthGuard } from '../auth/jwt-auth.guard';
import { TenantId } from '../tenant/tenant.decorator';
import { ObjectDefinition } from '../models/object-definition.model';
import { FieldDefinition } from '../models/field-definition.model';
import { Knex } from 'knex';
import { TenantDatabaseService } from '../tenant/tenant-database.service';
@Controller('setup/objects')
@UseGuards(JwtAuthGuard)
@@ -22,7 +20,7 @@ export class SetupObjectController {
constructor(
private objectService: ObjectService,
private fieldMapperService: FieldMapperService,
@Inject('KnexConnection') private readonly knex: Knex,
private tenantDbService: TenantDatabaseService,
) {}
@Get()
@@ -74,121 +72,55 @@ export class SetupObjectController {
return this.fieldMapperService.mapFieldToDTO(field);
}
// Access & Permissions endpoints
/**
* Get object access configuration
*/
@Get(':objectApiName/access')
async getAccess(
@Patch(':objectApiName')
async updateObjectDefinition(
@TenantId() tenantId: string,
@Param('objectApiName') objectApiName: string,
@Body() data: any,
) {
const objectDef = await ObjectDefinition.query(this.knex)
.findOne({ apiName: objectApiName })
.withGraphFetched('fields');
if (!objectDef) {
throw new Error('Object definition not found');
}
return {
accessModel: objectDef.accessModel,
publicRead: objectDef.publicRead,
publicCreate: objectDef.publicCreate,
publicUpdate: objectDef.publicUpdate,
publicDelete: objectDef.publicDelete,
ownerField: objectDef.ownerField,
fields: objectDef['fields'] || [],
};
return this.objectService.updateObjectDefinition(tenantId, objectApiName, data);
}
/**
* Update object access configuration
*/
@Put(':objectApiName/access')
async updateAccess(
@Get(':objectId/field-permissions')
async getFieldPermissions(
@TenantId() tenantId: string,
@Param('objectApiName') objectApiName: string,
@Body() dto: any,
@Param('objectId') objectId: string,
) {
console.log('dto', JSON.stringify(dto));
const objectDef = await ObjectDefinition.query(this.knex)
.findOne({ apiName: objectApiName });
if (!objectDef) {
throw new Error('Object definition not found');
}
return ObjectDefinition.query(this.knex).patchAndFetchById(objectDef.id, dto);
return this.objectService.getFieldPermissions(tenantId, objectId);
}
/**
* Create or update field-level permissions
*/
@Post(':objectApiName/fields/:fieldKey/permissions')
async setFieldPermissions(
@Put(':objectId/field-permissions')
async updateFieldPermission(
@TenantId() tenantId: string,
@Param('objectApiName') objectApiName: string,
@Param('fieldKey') fieldKey: string,
@Body() dto: any,
@Param('objectId') objectId: string,
@Body() data: { roleId: string; fieldDefinitionId: string; canRead: boolean; canEdit: boolean },
) {
const objectDef = await ObjectDefinition.query(this.knex)
.findOne({ apiName: objectApiName });
if (!objectDef) {
throw new Error('Object definition not found');
}
// Find the field definition
const field = await FieldDefinition.query(this.knex)
.findOne({
objectDefinitionId: objectDef.id,
apiName: fieldKey,
});
if (!field) {
throw new Error('Field definition not found');
}
// Update field permissions
return FieldDefinition.query(this.knex).patchAndFetchById(field.id, {
defaultReadable: dto.defaultReadable ?? field.defaultReadable,
defaultWritable: dto.defaultWritable ?? field.defaultWritable,
});
return this.objectService.updateFieldPermission(tenantId, data.roleId, data.fieldDefinitionId, data.canRead, data.canEdit);
}
/**
* Bulk set field permissions for an object
*/
@Put(':objectApiName/field-permissions')
async bulkSetFieldPermissions(
@Get(':objectApiName/permissions/:roleId')
async getObjectPermissions(
@TenantId() tenantId: string,
@Param('objectApiName') objectApiName: string,
@Body() fields: { fieldKey: string; defaultReadable: boolean; defaultWritable: boolean }[],
@Param('roleId') roleId: string,
) {
const objectDef = await ObjectDefinition.query(this.knex)
.findOne({ apiName: objectApiName });
return this.objectService.getObjectPermissions(tenantId, objectApiName, roleId);
}
if (!objectDef) {
throw new Error('Object definition not found');
}
// Update each field in the field_definitions table
for (const fieldUpdate of fields) {
await FieldDefinition.query(this.knex)
.where({
objectDefinitionId: objectDef.id,
apiName: fieldUpdate.fieldKey,
})
.patch({
defaultReadable: fieldUpdate.defaultReadable,
defaultWritable: fieldUpdate.defaultWritable,
});
}
return { success: true };
@Put(':objectApiName/permissions')
async updateObjectPermissions(
@TenantId() tenantId: string,
@Param('objectApiName') objectApiName: string,
@Body() data: {
roleId: string;
canCreate: boolean;
canRead: boolean;
canEdit: boolean;
canDelete: boolean;
canViewAll: boolean;
canModifyAll: boolean;
},
) {
return this.objectService.updateObjectPermissions(tenantId, objectApiName, data);
}
}

198
backend/src/rbac/ability.factory.ts Normal file
View File

@@ -0,0 +1,198 @@
import { AbilityBuilder, PureAbility, AbilityClass } from '@casl/ability';
import { Injectable } from '@nestjs/common';
import { User } from '../models/user.model';
import { RoleObjectPermission } from '../models/role-object-permission.model';
import { RoleFieldPermission } from '../models/role-field-permission.model';
import { RecordShare } from '../models/record-share.model';
// Define action types
export type Action = 'create' | 'read' | 'update' | 'delete' | 'view_all' | 'modify_all';
// Define subject types - can be string (object API name) or actual object with fields
export type Subject = string | { objectApiName: string; ownerId?: string; id?: string; [key: string]: any };
// Define field actions
export type FieldAction = 'read' | 'edit';
export type AppAbility = PureAbility<[Action, Subject], { field?: string }>;
@Injectable()
export class AbilityFactory {
/**
* Build CASL ability for a user based on their roles and permissions
* This aggregates permissions from all roles the user has
*/
async defineAbilityFor(
user: User & { roles?: Array<{ objectPermissions?: RoleObjectPermission[]; fieldPermissions?: RoleFieldPermission[] }> },
recordShares?: RecordShare[],
): Promise<AppAbility> {
const { can, cannot, build } = new AbilityBuilder<AppAbility>(PureAbility as AbilityClass<AppAbility>);
if (!user.roles || user.roles.length === 0) {
// No roles = no permissions
return build();
}
// Aggregate object permissions from all roles
const objectPermissionsMap = new Map<string, {
canCreate: boolean;
canRead: boolean;
canEdit: boolean;
canDelete: boolean;
canViewAll: boolean;
canModifyAll: boolean;
}>();
// Aggregate field permissions from all roles
const fieldPermissionsMap = new Map<string, {
canRead: boolean;
canEdit: boolean;
}>();
// Process all roles
for (const role of user.roles) {
// Aggregate object permissions
if (role.objectPermissions) {
for (const perm of role.objectPermissions) {
const existing = objectPermissionsMap.get(perm.objectDefinitionId) || {
canCreate: false,
canRead: false,
canEdit: false,
canDelete: false,
canViewAll: false,
canModifyAll: false,
};
// Union of permissions (if any role grants it, user has it)
objectPermissionsMap.set(perm.objectDefinitionId, {
canCreate: existing.canCreate || perm.canCreate,
canRead: existing.canRead || perm.canRead,
canEdit: existing.canEdit || perm.canEdit,
canDelete: existing.canDelete || perm.canDelete,
canViewAll: existing.canViewAll || perm.canViewAll,
canModifyAll: existing.canModifyAll || perm.canModifyAll,
});
}
}
// Aggregate field permissions
if (role.fieldPermissions) {
for (const perm of role.fieldPermissions) {
const existing = fieldPermissionsMap.get(perm.fieldDefinitionId) || {
canRead: false,
canEdit: false,
};
fieldPermissionsMap.set(perm.fieldDefinitionId, {
canRead: existing.canRead || perm.canRead,
canEdit: existing.canEdit || perm.canEdit,
});
}
}
}
// Convert aggregated permissions to CASL rules
for (const [objectId, perms] of objectPermissionsMap) {
// Create permission
if (perms.canCreate) {
can('create', objectId);
}
// Read permission
if (perms.canRead) {
can('read', objectId);
}
// View all permission (can see all records regardless of ownership)
if (perms.canViewAll) {
can('view_all', objectId);
}
// Edit permission
if (perms.canEdit) {
can('update', objectId);
}
// Modify all permission (can edit all records regardless of ownership)
if (perms.canModifyAll) {
can('modify_all', objectId);
}
// Delete permission
if (perms.canDelete) {
can('delete', objectId);
}
}
// Add record sharing permissions
if (recordShares) {
for (const share of recordShares) {
// Only add if share is active (not expired, not revoked)
const now = new Date();
const isExpired = share.expiresAt && share.expiresAt < now;
const isRevoked = share.revokedAt !== null;
if (!isExpired && !isRevoked) {
// Note: Record-level sharing will be checked in authorization service
// CASL abilities are primarily for object-level permissions
// Individual record access is validated in applyScopeToQuery
}
}
}
return build();
}
/**
* Check if user can access a specific field
* Returns true if user has permission or if no restriction exists
*/
canAccessField(
fieldDefinitionId: string,
action: FieldAction,
user: User & { roles?: Array<{ fieldPermissions?: RoleFieldPermission[] }> },
): boolean {
if (!user.roles || user.roles.length === 0) {
return false;
}
// Collect all field permissions from all roles
const allFieldPermissions: RoleFieldPermission[] = [];
for (const role of user.roles) {
if (role.fieldPermissions) {
allFieldPermissions.push(...role.fieldPermissions);
}
}
// If there are NO field permissions configured at all, allow by default
if (allFieldPermissions.length === 0) {
return true;
}
// If field permissions exist, check for explicit grants (union of all roles)
for (const role of user.roles) {
if (role.fieldPermissions) {
const fieldPerm = role.fieldPermissions.find(fp => fp.fieldDefinitionId === fieldDefinitionId);
if (fieldPerm) {
if (action === 'read' && fieldPerm.canRead) return true;
if (action === 'edit' && fieldPerm.canEdit) return true;
}
}
}
// Field permissions exist but this field is not explicitly granted → deny
return false;
}
/**
* Filter fields based on user permissions
* Returns array of field IDs the user can access with the specified action
*/
filterFields(
fieldDefinitionIds: string[],
action: FieldAction,
user: User & { roles?: Array<{ fieldPermissions?: RoleFieldPermission[] }> },
): string[] {
return fieldDefinitionIds.filter(fieldId => this.canAccessField(fieldId, action, user));
}
}

282
backend/src/rbac/authorization.service.ts Normal file
View File

@@ -0,0 +1,282 @@
import { Injectable, ForbiddenException } from '@nestjs/common';
import { Knex } from 'knex';
import { User } from '../models/user.model';
import { ObjectDefinition } from '../models/object-definition.model';
import { FieldDefinition } from '../models/field-definition.model';
import { RecordShare } from '../models/record-share.model';
import { AbilityFactory, AppAbility, Action } from './ability.factory';
import { DynamicModelFactory } from '../object/models/dynamic-model.factory';
import { subject } from '@casl/ability';
@Injectable()
export class AuthorizationService {
constructor(private abilityFactory: AbilityFactory) {}
/**
* Apply authorization scope to a query based on OWD and user permissions
* This determines which records the user can see
* Modifies the query in place and returns void
*/
async applyScopeToQuery<T = any>(
query: any, // Accept both Knex and Objection query builders
objectDef: ObjectDefinition,
user: User & { roles?: any[] },
action: Action,
knex: Knex,
): Promise<void> {
// Get user's ability
const recordShares = await this.getActiveRecordShares(objectDef.id, user.id, knex);
const ability = await this.abilityFactory.defineAbilityFor(user, recordShares);
// Check if user has the base permission for this action
// Use object ID, not API name, since permissions are stored by object ID
if (!ability.can(action, objectDef.id)) {
// No permission at all - return empty result
query.where(knex.raw('1 = 0'));
return;
}
// Check special permissions
const hasViewAll = ability.can('view_all', objectDef.id);
const hasModifyAll = ability.can('modify_all', objectDef.id);
// If user has view_all or modify_all, they can see all records
if (hasViewAll || hasModifyAll) {
// No filtering needed
return;
}
// Apply OWD (Org-Wide Default) restrictions
switch (objectDef.orgWideDefault) {
case 'public_read_write':
// Everyone can see all records
return;
case 'public_read':
// Everyone can see all records (write operations checked separately)
return;
case 'private':
default:
// Only owner and explicitly shared records
await this.applyPrivateScope(query, objectDef, user, recordShares, knex);
return;
}
}
/**
* Apply private scope: owner + shared records
*/
private async applyPrivateScope<T = any>(
query: any, // Accept both Knex and Objection query builders
objectDef: ObjectDefinition,
user: User,
recordShares: RecordShare[],
knex: Knex,
): Promise<void> {
const tableName = this.getTableName(objectDef.apiName);
// Check if table has ownerId column
const hasOwner = await knex.schema.hasColumn(tableName, 'ownerId');
if (!hasOwner && recordShares.length === 0) {
// No ownership and no shares - user can't see anything
query.where(knex.raw('1 = 0'));
return;
}
// Build conditions: ownerId = user OR record shared with user
query.where((builder) => {
if (hasOwner) {
builder.orWhere(`${tableName}.ownerId`, user.id);
}
if (recordShares.length > 0) {
const sharedRecordIds = recordShares.map(share => share.recordId);
builder.orWhereIn(`${tableName}.id`, sharedRecordIds);
}
});
}
/**
* Check if user can perform action on a specific record
*/
async canPerformAction(
action: Action,
objectDef: ObjectDefinition,
record: any,
user: User & { roles?: any[] },
knex: Knex,
): Promise<boolean> {
const recordShares = await this.getActiveRecordShares(objectDef.id, user.id, knex);
const ability = await this.abilityFactory.defineAbilityFor(user, recordShares);
// Check base permission - use object ID not API name
if (!ability.can(action, objectDef.id)) {
return false;
}
// Check special permissions - use object ID not API name
const hasViewAll = ability.can('view_all', objectDef.id);
const hasModifyAll = ability.can('modify_all', objectDef.id);
// canViewAll only grants read access to all records
if (action === 'read' && hasViewAll) {
return true;
}
// canModifyAll grants edit/delete access to all records
if ((action === 'update' || action === 'delete') && hasModifyAll) {
return true;
}
// Check OWD
switch (objectDef.orgWideDefault) {
case 'public_read_write':
return true;
case 'public_read':
if (action === 'read') return true;
// For write actions, check ownership
return record.ownerId === user.id;
case 'private':
default:
// Check ownership
if (record.ownerId === user.id) return true;
// Check if record is shared with user
const share = recordShares.find(s => s.recordId === record.id);
if (share) {
if (action === 'read' && share.accessLevel.canRead) return true;
if (action === 'update' && share.accessLevel.canEdit) return true;
if (action === 'delete' && share.accessLevel.canDelete) return true;
}
return false;
}
}
/**
* Filter data based on field-level permissions
* Removes fields the user cannot read
*/
async filterReadableFields(
data: any,
fields: FieldDefinition[],
user: User & { roles?: any[] },
): Promise<any> {
const filtered: any = {};
// Always include id - it's required for navigation and record identification
if (data.id !== undefined) {
filtered.id = data.id;
}
for (const field of fields) {
if (this.abilityFactory.canAccessField(field.id, 'read', user)) {
if (data[field.apiName] !== undefined) {
filtered[field.apiName] = data[field.apiName];
}
// For lookup fields, also include the related object (e.g., ownerId -> owner)
if (field.type === 'LOOKUP') {
const relationName = DynamicModelFactory.getRelationName(field.apiName);
if (data[relationName] !== undefined) {
filtered[relationName] = data[relationName];
}
}
}
}
return filtered;
}
/**
* Filter data based on field-level permissions
* Removes fields the user cannot edit
*/
async filterEditableFields(
data: any,
fields: FieldDefinition[],
user: User & { roles?: any[] },
): Promise<any> {
const filtered: any = {};
for (const field of fields) {
if (this.abilityFactory.canAccessField(field.id, 'edit', user)) {
if (data[field.apiName] !== undefined) {
filtered[field.apiName] = data[field.apiName];
}
}
}
return filtered;
}
/**
* Get active record shares for a user on an object
*/
private async getActiveRecordShares(
objectDefinitionId: string,
userId: string,
knex: Knex,
): Promise<RecordShare[]> {
const now = new Date();
return await RecordShare.query(knex)
.where('objectDefinitionId', objectDefinitionId)
.where('granteeUserId', userId)
.whereNull('revokedAt')
.where((builder) => {
builder.whereNull('expiresAt').orWhere('expiresAt', '>', now);
});
}
/**
* Check if user has permission to create records
*/
async canCreate(
objectDef: ObjectDefinition,
user: User & { roles?: any[] },
): Promise<boolean> {
const ability = await this.abilityFactory.defineAbilityFor(user, []);
return ability.can('create', objectDef.id);
}
/**
* Throw exception if user cannot perform action
*/
async assertCanPerformAction(
action: Action,
objectDef: ObjectDefinition,
record: any,
user: User & { roles?: any[] },
knex: Knex,
): Promise<void> {
const can = await this.canPerformAction(action, objectDef, record, user, knex);
if (!can) {
throw new ForbiddenException(`You do not have permission to ${action} this record`);
}
}
/**
* Get table name from API name
*/
private getTableName(apiName: string): string {
// Convert CamelCase to snake_case and pluralize
const snakeCase = apiName
.replace(/([A-Z])/g, '_$1')
.toLowerCase()
.replace(/^_/, '');
// Simple pluralization
if (snakeCase.endsWith('y')) {
return snakeCase.slice(0, -1) + 'ies';
} else if (snakeCase.endsWith('s')) {
return snakeCase;
} else {
return snakeCase + 's';
}
}
}

12
backend/src/rbac/rbac.module.ts
View File

@@ -1,14 +1,14 @@
import { Module } from '@nestjs/common';
import { RbacService } from './rbac.service';
import { ShareController } from './share.controller';
import { RoleController, RoleRuleController } from './role.controller';
import { UserController } from './user.controller';
import { AbilityFactory } from './ability.factory';
import { AuthorizationService } from './authorization.service';
import { SetupRolesController } from './setup-roles.controller';
import { TenantModule } from '../tenant/tenant.module';
@Module({
imports: [TenantModule],
providers: [RbacService],
controllers: [ShareController, RoleController, RoleRuleController, UserController],
exports: [RbacService],
controllers: [SetupRolesController],
providers: [RbacService, AbilityFactory, AuthorizationService],
exports: [RbacService, AbilityFactory, AuthorizationService],
})
export class RbacModule {}

137
backend/src/rbac/role.controller.ts
View File

@@ -1,137 +0,0 @@
import {
Controller,
Get,
Post,
Put,
Delete,
Body,
Param,
UseGuards,
Inject,
} from '@nestjs/common';
import { JwtAuthGuard } from '../auth/jwt-auth.guard';
import { Role } from '../models/role.model';
import { RoleRule } from '../models/role-rule.model';
import { Knex } from 'knex';
export class CreateRoleDto {
name: string;
guardName?: string;
description?: string;
}
export class UpdateRoleDto {
name?: string;
description?: string;
}
export class CreateRoleRuleDto {
roleId: string;
rulesJson: any[]; // Array of CASL rules
}
export class UpdateRoleRuleDto {
rulesJson: any[];
}
@Controller('roles')
@UseGuards(JwtAuthGuard)
export class RoleController {
constructor(@Inject('KnexConnection') private readonly knex: Knex) {}
/**
* List all roles
*/
@Get()
async list() {
return Role.query(this.knex).withGraphFetched('[roleRules]');
}
/**
* Get a single role by ID
*/
@Get(':id')
async get(@Param('id') id: string) {
return Role.query(this.knex)
.findById(id)
.withGraphFetched('[roleRules, permissions]');
}
/**
* Create a new role
*/
@Post()
async create(@Body() createDto: CreateRoleDto) {
return Role.query(this.knex).insert({
name: createDto.name,
guardName: createDto.guardName || 'api',
description: createDto.description,
});
}
/**
* Update a role
*/
@Put(':id')
async update(@Param('id') id: string, @Body() updateDto: UpdateRoleDto) {
return Role.query(this.knex).patchAndFetchById(id, updateDto);
}
/**
* Delete a role
*/
@Delete(':id')
async delete(@Param('id') id: string) {
await Role.query(this.knex).deleteById(id);
return { success: true };
}
}
@Controller('role-rules')
@UseGuards(JwtAuthGuard)
export class RoleRuleController {
constructor(@Inject('KnexConnection') private readonly knex: Knex) {}
/**
* Get rules for a role
*/
@Get('role/:roleId')
async getForRole(@Param('roleId') roleId: string) {
return RoleRule.query(this.knex).where('roleId', roleId);
}
/**
* Create or update role rules
* This will replace existing rules for the role
*/
@Post()
async createOrUpdate(@Body() dto: CreateRoleRuleDto) {
// Delete existing rules for this role
await RoleRule.query(this.knex).where('roleId', dto.roleId).delete();
// Insert new rules
return RoleRule.query(this.knex).insert({
roleId: dto.roleId,
rulesJson: dto.rulesJson,
});
}
/**
* Update role rules by ID
*/
@Put(':id')
async update(@Param('id') id: string, @Body() dto: UpdateRoleRuleDto) {
return RoleRule.query(this.knex).patchAndFetchById(id, {
rulesJson: dto.rulesJson,
});
}
/**
* Delete role rules
*/
@Delete(':id')
async delete(@Param('id') id: string) {
await RoleRule.query(this.knex).deleteById(id);
return { success: true };
}
}

23
backend/src/rbac/setup-roles.controller.ts Normal file
View File

@@ -0,0 +1,23 @@
import {
Controller,
Get,
UseGuards,
} from '@nestjs/common';
import { JwtAuthGuard } from '../auth/jwt-auth.guard';
import { TenantId } from '../tenant/tenant.decorator';
import { TenantDatabaseService } from '../tenant/tenant-database.service';
import { Role } from '../models/role.model';
@Controller('setup/roles')
@UseGuards(JwtAuthGuard)
export class SetupRolesController {
constructor(private tenantDbService: TenantDatabaseService) {}
@Get()
async getRoles(@TenantId() tenantId: string) {
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
return await Role.query(knex).select('*').orderBy('name', 'asc');
}
}

243
backend/src/rbac/share.controller.ts
View File

@@ -1,243 +0,0 @@
import {
Controller,
Get,
Post,
Patch,
Delete,
Body,
Param,
Query,
UseGuards,
ForbiddenException,
NotFoundException,
} from '@nestjs/common';
import { IsString, IsArray, IsOptional, IsDateString } from 'class-validator';
import { JwtAuthGuard } from '../auth/jwt-auth.guard';
import { CurrentUser } from '../auth/current-user.decorator';
import { TenantId } from '../tenant/tenant.decorator';
import { TenantDatabaseService } from '../tenant/tenant-database.service';
export class CreateShareDto {
@IsString()
objectApiName: string;
@IsString()
recordId: string;
@IsString()
granteeUserId: string;
@IsArray()
@IsString({ each: true })
actions: string[]; // ["read"], ["read", "update"], etc.
@IsOptional()
@IsArray()
@IsString({ each: true })
fields?: string[]; // Optional field scoping
@IsOptional()
@IsDateString()
expiresAt?: string;
}
export class UpdateShareDto {
@IsOptional()
@IsArray()
@IsString({ each: true })
actions?: string[];
@IsOptional()
@IsArray()
@IsString({ each: true })
fields?: string[];
@IsOptional()
@IsDateString()
expiresAt?: string;
}
@Controller('rbac/shares')
@UseGuards(JwtAuthGuard)
export class ShareController {
constructor(private tenantDbService: TenantDatabaseService) {}
/**
* Create a new share
* Only the owner (or users with share permission) can share a record
*/
@Post()
async create(
@TenantId() tenantId: string,
@CurrentUser() currentUser: any,
@Body() createDto: CreateShareDto,
) {
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
// Get object definition by apiName
const objectDef = await knex('object_definitions')
.where({ apiName: createDto.objectApiName })
.first();
if (!objectDef) {
throw new NotFoundException('Object definition not found');
}
// Get the table name for the object
const tableName = this.getTableName(createDto.objectApiName);
// Verify the user owns the record
const record = await knex(tableName)
.where({ id: createDto.recordId })
.first();
if (!record) {
throw new NotFoundException('Record not found');
}
if (record.ownerId !== currentUser.userId) {
throw new ForbiddenException('Only the record owner can share it');
}
// Create the share
const shareId = require('crypto').randomUUID();
await knex('record_shares').insert({
id: shareId,
object_definition_id: objectDef.id,
record_id: createDto.recordId,
grantee_user_id: createDto.granteeUserId,
granted_by_user_id: currentUser.userId,
actions: JSON.stringify(createDto.actions),
fields: createDto.fields ? JSON.stringify(createDto.fields) : null,
expires_at: createDto.expiresAt,
created_at: knex.fn.now(),
});
const share = await knex('record_shares').where({ id: shareId }).first();
return {
...share,
actions: typeof share.actions === 'string' ? JSON.parse(share.actions) : share.actions,
fields: share.fields ? (typeof share.fields === 'string' ? JSON.parse(share.fields) : share.fields) : null,
};
}
private getTableName(objectApiName: string): string {
const snakeCase = objectApiName
.replace(/([A-Z])/g, '_$1')
.toLowerCase()
.replace(/^_/, '');
if (snakeCase.endsWith('y')) {
return snakeCase.slice(0, -1) + 'ies';
} else if (snakeCase.endsWith('s')) {
return snakeCase;
} else {
return snakeCase + 's';
}
}
/**
* List shares for a specific record
* Only owner or users with access can see shares
*/
@Get(':objectApiName/:recordId')
async listForRecord(
@TenantId() tenantId: string,
@CurrentUser() currentUser: any,
@Param('objectApiName') objectApiName: string,
@Param('recordId') recordId: string,
) {
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
// Get object definition
const objectDef = await knex('object_definitions')
.where({ apiName: objectApiName })
.first();
if (!objectDef) {
throw new NotFoundException('Object definition not found');
}
// Get shares for this record
const shares = await knex('record_shares')
.where({
object_definition_id: objectDef.id,
record_id: recordId,
})
.whereNull('revoked_at')
.select('*');
// Fetch user details for each share
const sharesWithUsers = await Promise.all(
shares.map(async (share: any) => {
const granteeUser = await knex('users')
.where({ id: share.grantee_user_id })
.select('id', 'email', 'firstName', 'lastName', 'name')
.first();
const grantedByUser = await knex('users')
.where({ id: share.granted_by_user_id })
.select('id', 'email', 'firstName', 'lastName', 'name')
.first();
return {
id: share.id,
recordId: share.record_id,
actions: typeof share.actions === 'string' ? JSON.parse(share.actions) : share.actions,
fields: share.fields ? (typeof share.fields === 'string' ? JSON.parse(share.fields) : share.fields) : null,
expiresAt: share.expires_at,
createdAt: share.created_at,
granteeUser: {
id: granteeUser.id,
email: granteeUser.email,
name: granteeUser.firstName && granteeUser.lastName
? `${granteeUser.firstName} ${granteeUser.lastName}`
: granteeUser.name || granteeUser.email,
},
grantedByUser: {
id: grantedByUser.id,
email: grantedByUser.email,
name: grantedByUser.firstName && grantedByUser.lastName
? `${grantedByUser.firstName} ${grantedByUser.lastName}`
: grantedByUser.name || grantedByUser.email,
},
};
})
);
return sharesWithUsers;
}
/**
* Revoke a share (soft delete)
*/
@Delete(':id')
async revoke(
@TenantId() tenantId: string,
@CurrentUser() currentUser: any,
@Param('id') id: string,
) {
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
const share = await knex('record_shares').where({ id }).first();
if (!share) {
throw new NotFoundException('Share not found');
}
// Only the grantor can revoke
if (share.granted_by_user_id !== currentUser.userId) {
throw new ForbiddenException('Unauthorized');
}
await knex('record_shares')
.where({ id })
.update({ revoked_at: knex.fn.now() });
return { success: true };
}
}

41
backend/src/rbac/user.controller.ts
View File

@@ -1,41 +0,0 @@
import { Controller, Get, UseGuards } from '@nestjs/common';
import { JwtAuthGuard } from '../auth/jwt-auth.guard';
import { TenantId } from '../tenant/tenant.decorator';
import { CurrentUser } from '../auth/current-user.decorator';
import { TenantDatabaseService } from '../tenant/tenant-database.service';
import { User } from '../models/user.model';
@Controller('rbac/users')
@UseGuards(JwtAuthGuard)
export class UserController {
constructor(private tenantDbService: TenantDatabaseService) {}
@Get()
async getUsers(
@TenantId() tenantId: string,
@CurrentUser() currentUser: any,
) {
const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
// Get all active users from tenant database (excluding current user)
let query = User.query(knex)
.select('id', 'email', 'firstName', 'lastName')
.where('isActive', true);
// Exclude current user if we have their ID
if (currentUser?.userId) {
query = query.whereNot('id', currentUser.userId);
}
const users = await query;
return users.map((user) => ({
id: user.id,
email: user.email,
name: user.firstName && user.lastName
? `${user.firstName} ${user.lastName}`
: user.email,
}));
}
}

5
backend/src/tenant/central-database.service.ts
View File

@@ -1,15 +1,14 @@
import Knex from 'knex';
import type { Knex as KnexType } from 'knex';
import { Model } from 'objection';
import { CentralTenant, CentralDomain, CentralUser } from '../models/central.model';
let centralKnex: KnexType | null = null;
let centralKnex: Knex.Knex | null = null;
/**
* Get or create a Knex instance for the central database
* This is used for Objection models that work with central entities
*/
export function getCentralKnex(): KnexType {
export function getCentralKnex(): Knex.Knex {
if (!centralKnex) {
const centralDbUrl = process.env.CENTRAL_DATABASE_URL;

27
backend/src/tenant/tenant.module.ts
View File

@@ -1,5 +1,4 @@
import { Module, NestModule, MiddlewareConsumer, Scope } from '@nestjs/common';
import { REQUEST } from '@nestjs/core';
import { Module, NestModule, MiddlewareConsumer } from '@nestjs/common';
import { TenantMiddleware } from './tenant.middleware';
import { TenantDatabaseService } from './tenant-database.service';
import { TenantProvisioningService } from './tenant-provisioning.service';
@@ -14,30 +13,8 @@ import { PrismaModule } from '../prisma/prisma.module';
TenantDatabaseService,
TenantProvisioningService,
TenantMiddleware,
{
provide: 'KnexConnection',
scope: Scope.REQUEST,
inject: [REQUEST, TenantDatabaseService],
useFactory: async (request: any, tenantDbService: TenantDatabaseService) => {
// Try to get subdomain first (for domain-based routing)
const subdomain = request.raw?.subdomain || request.subdomain;
const tenantId = request.raw?.tenantId || request.tenantId;
if (!subdomain && !tenantId) {
throw new Error('Neither subdomain nor tenant ID found in request');
}
// Prefer subdomain lookup (more reliable for domain-based routing)
if (subdomain) {
return await tenantDbService.getTenantKnexByDomain(subdomain);
}
// Fallback to tenant ID lookup
return await tenantDbService.getTenantKnexById(tenantId);
},
},
],
exports: [TenantDatabaseService, TenantProvisioningService, 'KnexConnection'],
exports: [TenantDatabaseService, TenantProvisioningService],
})
export class TenantModule implements NestModule {
configure(consumer: MiddlewareConsumer) {

296
docs/AUTHORIZATION_SYSTEM.md
View File

@@ -1,296 +0,0 @@
# Polymorphic Record Sharing + Authorization System
This document describes the implementation of a comprehensive authorization system using CASL, Objection.js, and NestJS.
## Overview
The system supports:
- **Global object policies** - Public/private access, default permissions per object type
- **Role-based access** - Permissions assigned to roles, with CASL rule storage
- **Per-record sharing** - Polymorphic sharing where owners can grant specific users access to individual records
- **Field-level permissions** - Fine-grained control over which fields can be read/written
## Architecture
### Database Schema
#### `object_definitions` (Enhanced)
- `accessModel`: 'public' | 'owner' | 'mixed'
- `publicRead/Create/Update/Delete`: Boolean flags for public access
- `ownerField`: Field name storing record owner (default: 'ownerId')
#### `field_definitions` (Enhanced)
- `defaultReadable`: Boolean - Can this field be read by default
- `defaultWritable`: Boolean - Can this field be written by default
These permission flags are added directly to the existing `field_definitions` table, keeping all field metadata in one place.
#### `role_rules` (New)
- `roleId`: FK to roles
- `rulesJson`: JSON array of CASL rules
#### `record_shares` (New)
Polymorphic sharing table:
- `objectDefinitionId`: FK to object_definitions
- `recordId`: String (supports UUID/int)
- `granteeUserId`: User receiving access
- `grantedByUserId`: User granting access
- `actions`: JSON array of actions ["read", "update", etc.]
- `fields`: Optional JSON array of field names
- `expiresAt/revokedAt`: Optional expiry and revocation timestamps
### Backend Components
#### AbilityFactory (`src/auth/ability.factory.ts`)
Builds CASL abilities from three layers:
1. **Global rules** - From object_definitions and object_fields
2. **Role rules** - From role_rules.rulesJson
3. **Share rules** - From record_shares for the user
```typescript
const ability = await abilityFactory.buildForUser(user, knex);
if (ability.can('read', 'Post')) {
// User can read posts
}
```
#### Query Scoping (`src/auth/query-scope.util.ts`)
SQL-level filtering for list queries:
```typescript
import { applyReadScope } from '@/auth/query-scope.util';
const query = Post.query(knex);
applyReadScope(query, user, objectDefinition, knex);
// Query now only returns records user can access
```
Logic:
1. If `publicRead` is true → allow all
2. Else → owner OR valid share exists
#### Guards & Decorators
- `AbilitiesGuard` - Checks CASL abilities on routes
- `@CheckAbility()` - Decorator to require specific permissions
- `@CurrentUser()` - Inject current user
- `@CurrentAbility()` - Inject CASL ability
#### Controllers
**ShareController** (`src/rbac/share.controller.ts`)
- `POST /shares` - Create a share
- `GET /shares/record/:objectDefinitionId/:recordId` - List shares for a record
- `GET /shares/granted` - List shares granted by current user
- `GET /shares/received` - List shares received by current user
- `PATCH /shares/:id` - Update a share
- `DELETE /shares/:id` - Revoke a share
**RoleController** (`src/rbac/role.controller.ts`)
- Standard CRUD for roles
- `RoleRuleController` manages CASL rules per role
**ObjectAccessController** (`src/object/object-access.controller.ts`)
- `GET /setup/objects/:apiName/access` - Get access config
- `PUT /setup/objects/:apiName/access` - Update access model
- `POST /setup/objects/:apiName/fields/:fieldKey/permissions` - Set field permissions
- `PUT /setup/objects/:apiName/field-permissions` - Bulk update field permissions
### Frontend Components
#### ObjectAccessSettings (`components/ObjectAccessSettings.vue`)
Integrated into object management page as "Access & Permissions" tab:
- Configure access model (public/owner/mixed)
- Set public CRUD permissions
- Configure owner field
- Set default read/write permissions per field
#### RecordShareDialog (`components/RecordShareDialog.vue`)
Dialog for sharing individual records:
- List current shares
- Add new share with user email
- Select read/update permissions
- Optional field-level scoping
- Optional expiration date
- Revoke shares
#### Role Management (`pages/setup/roles.vue`)
Complete role management interface:
- List all roles
- Create new roles
- Delete roles
- Edit role permissions
#### RolePermissionsEditor (`components/RolePermissionsEditor.vue`)
Granular permission editor:
- Configure CRUD permissions per object type
- Apply conditions (e.g., "ownerId = $userId")
- Field-level restrictions (future)
## Usage Examples
### 1. Set Object to Owner-Only Access
```typescript
await api.put('/setup/objects/Post/access', {
accessModel: 'owner',
publicRead: false,
ownerField: 'ownerId'
});
```
### 2. Share a Record
```typescript
await api.post('/shares', {
objectDefinitionId: 'abc-123',
recordId: 'post-456',
granteeUserId: 'user-789',
actions: ['read', 'update'],
fields: ['title', 'body'], // Optional field scoping
expiresAt: '2025-12-31T23:59:59Z' // Optional expiry
});
```
### 3. Create Role with Permissions
```typescript
// Create role
const role = await api.post('/roles', {
name: 'Account Manager',
description: 'Can manage accounts'
});
// Set permissions
await api.post('/role-rules', {
roleId: role.id,
rulesJson: [
{
action: ['read', 'update'],
subject: 'Account',
conditions: { ownerId: '$userId' } // Only own accounts
},
{
action: ['read'],
subject: 'Contact' // Can read all contacts
}
]
});
```
### 4. Query with Authorization
```typescript
// In a controller
async getRecords(user: User) {
const objectDef = await ObjectDefinition.query(this.knex)
.findOne({ apiName: 'Post' });
const query = Post.query(this.knex);
applyReadScope(query, user, objectDef, this.knex);
return query; // Only returns records user can read
}
```
### 5. Check Instance Permission
```typescript
// With CASL
const post = await Post.query().findById(id);
if (ability.can('update', subject(post, 'Post'))) {
// User can update this post
}
```
## Migration Guide
1. **Run Migration**
```bash
npm run migrate:latest
```
2. **Update Existing Objects**
Set default access model for existing object types:
```sql
UPDATE object_definitions
SET access_model = 'owner',
owner_field = 'ownerId'
WHERE access_model IS NULL;
```
3. **Update Controllers**
Add query scoping to list endpoints:
```typescript
import { applyReadScope } from '@/auth/query-scope.util';
// Before
const records = await MyModel.query();
// After
const records = await applyReadScope(
MyModel.query(),
user,
objectDef,
knex
);
```
4. **Add Guards**
Protect routes with ability checks:
```typescript
@UseGuards(JwtAuthGuard, AbilitiesGuard)
@CheckAbility({ action: 'read', subject: 'Post' })
async findAll() {
// ...
}
```
## Security Considerations
1. **Always use SQL scoping for lists** - Don't rely on post-fetch filtering
2. **Validate share ownership** - Only grantor can update/revoke shares
3. **Check expiry and revocation** - Filter out invalid shares in queries
4. **Field-level filtering** - Strip unauthorized fields from request bodies
5. **Tenant isolation** - All queries should be scoped to current tenant (if multi-tenant)
## Testing
### Unit Tests
Test ability building:
```typescript
it('should allow owner to read their records', async () => {
const ability = await abilityFactory.buildForUser(user, knex);
const post = { id: '123', ownerId: user.id };
expect(ability.can('read', subject(post, 'Post'))).toBe(true);
});
```
### Integration Tests
Test query scoping:
```typescript
it('should only return owned records', async () => {
const query = Post.query(knex);
applyReadScope(query, user, objectDef, knex);
const records = await query;
expect(records.every(r => r.ownerId === user.id)).toBe(true);
});
```
## Future Enhancements
- [ ] Group/team sharing (share with multiple users)
- [ ] Public link sharing (token-based)
- [ ] Audit log for shares
- [ ] Share templates
- [ ] Cascading shares (share related records)
- [ ] Time-limited shares with auto-expiry
- [ ] Share approval workflow
- [ ] Delegation (share on behalf of another user)
## API Reference
See individual controller files for detailed API documentation:
- [ShareController](./backend/src/rbac/share.controller.ts)
- [RoleController](./backend/src/rbac/role.controller.ts)
- [ObjectAccessController](./backend/src/object/object-access.controller.ts)

211
docs/SALESFORCE_AUTHORIZATION.md Normal file
View File

@@ -0,0 +1,211 @@
# Salesforce-Style Authorization System
## Overview
Implemented a comprehensive authorization system based on Salesforce's model with:
- **Org-Wide Defaults (OWD)** for record visibility
- **Role-based permissions** for object and field access
- **Record sharing** for granular access control
- **CASL** for flexible permission evaluation
## Architecture
### 1. Org-Wide Defaults (OWD)
Controls baseline record visibility for each object:
- `private`: Only owner can see records
- `public_read`: Everyone can see, only owner can edit/delete
- `public_read_write`: Everyone can see and modify all records
### 2. Role-Based Object Permissions
Table: `role_object_permissions`
- `canCreate`: Can create new records
- `canRead`: Can read records (subject to OWD)
- `canEdit`: Can edit records (subject to OWD)
- `canDelete`: Can delete records (subject to OWD)
- `canViewAll`: Override OWD to see ALL records
- `canModifyAll`: Override OWD to edit ALL records
### 3. Field-Level Security
Table: `role_field_permissions`
- `canRead`: Can view field value
- `canEdit`: Can modify field value
### 4. Record Sharing
Table: `record_shares`
Grants specific users access to individual records with:
```json
{
"canRead": boolean,
"canEdit": boolean,
"canDelete": boolean
}
```
## Permission Evaluation Flow
```
1. Check role_object_permissions
├─ Does user have canCreate/Read/Edit/Delete?
│ └─ NO → Deny
│ └─ YES → Continue
│
2. Check canViewAll / canModifyAll
├─ Does user have special "all" permissions?
│ └─ YES → Grant access
│ └─ NO → Continue
│
3. Check OWD (orgWideDefault)
├─ public_read_write → Grant access
├─ public_read → Grant read, check ownership for write
└─ private → Check ownership or sharing
4. Check Ownership
├─ Is user the record owner?
│ └─ YES → Grant access
│ └─ NO → Continue
│
5. Check Record Shares
└─ Is record explicitly shared with user?
└─ Check accessLevel permissions
```
## Field-Level Security
Fields are filtered after record access is granted:
1. User queries records → Apply record-level scope
2. System filters readable fields based on `role_field_permissions`
3. User updates records → System filters editable fields
## Key Features
### Multiple Role Support
- Users can have multiple roles
- Permissions are **unioned** (any role grants = user has it)
- More flexible than Salesforce's single profile model
### Active Share Detection
- Shares can expire (`expiresAt`)
- Shares can be revoked (`revokedAt`)
- Only active shares are evaluated
### CASL Integration
- Dynamic ability building per request
- Condition-based rules
- Field-level permission support
## Usage Example
```typescript
// In a controller/service
constructor(
private authService: AuthorizationService,
private tenantDbService: TenantDatabaseService,
) {}
async getRecords(tenantId: string, objectApiName: string, userId: string) {
const knex = await this.tenantDbService.getTenantKnex(tenantId);
// Get user with roles
const user = await User.query(knex)
.findById(userId)
.withGraphFetched('[roles.[objectPermissions, fieldPermissions]]');
// Get object definition
const objectDef = await ObjectDefinition.query(knex)
.findOne({ apiName: objectApiName });
// Build query with authorization scope
let query = knex(objectApiName.toLowerCase());
query = await this.authService.applyScopeToQuery(
query,
objectDef,
user,
'read',
knex,
);
const records = await query;
// Get field definitions
const fields = await FieldDefinition.query(knex)
.where('objectDefinitionId', objectDef.id);
// Filter fields user can read
const filteredRecords = await Promise.all(
records.map(record =>
this.authService.filterReadableFields(record, fields, user)
)
);
return filteredRecords;
}
async updateRecord(tenantId: string, objectApiName: string, recordId: string, data: any, userId: string) {
const knex = await this.tenantDbService.getTenantKnex(tenantId);
const user = await User.query(knex)
.findById(userId)
.withGraphFetched('[roles.[objectPermissions, fieldPermissions]]');
const objectDef = await ObjectDefinition.query(knex)
.findOne({ apiName: objectApiName });
// Get existing record
const record = await knex(objectApiName.toLowerCase())
.where({ id: recordId })
.first();
if (!record) {
throw new NotFoundException('Record not found');
}
// Check if user can update this record
await this.authService.assertCanPerformAction(
'update',
objectDef,
record,
user,
knex,
);
// Get field definitions
const fields = await FieldDefinition.query(knex)
.where('objectDefinitionId', objectDef.id);
// Filter to only editable fields
const editableData = await this.authService.filterEditableFields(
data,
fields,
user,
);
// Perform update
await knex(objectApiName.toLowerCase())
.where({ id: recordId })
.update(editableData);
return knex(objectApiName.toLowerCase())
.where({ id: recordId })
.first();
}
```
## Migration
Run the migration to add authorization tables:
```bash
npm run knex migrate:latest
```
The migration creates:
- `orgWideDefault` column in `object_definitions`
- `role_object_permissions` table
- `role_field_permissions` table
- `record_shares` table
## Next Steps
1. **Migrate existing data**: Set default `orgWideDefault` values for existing objects
2. **Create default roles**: Create Admin, Standard User, etc. with appropriate permissions
3. **Update API endpoints**: Integrate authorization service into all CRUD operations
4. **UI for permission management**: Build admin interface to manage role permissions
5. **Sharing UI**: Build interface for users to share records with others

344
frontend/components/FieldLevelSecurity.vue Normal file
View File

@@ -0,0 +1,344 @@
<template>
<Card>
<CardHeader>
<CardTitle>Field-Level Security</CardTitle>
<CardDescription>
Control which fields each role can read and edit
</CardDescription>
</CardHeader>
<CardContent>
<div v-if="loading" class="flex items-center justify-center py-8">
<div class="animate-spin rounded-full h-8 w-8 border-b-2 border-primary"></div>
</div>
<div v-else-if="roles.length === 0" class="text-sm text-muted-foreground py-4">
No roles available. Create roles first to manage field-level permissions.
</div>
<div v-else class="space-y-6">
<!-- Role Selector -->
<div class="space-y-2">
<Label>Select Role</Label>
<Select v-model="selectedRoleId" @update:model-value="(value) => selectedRoleId = value">
<SelectTrigger class="w-full">
<SelectValue placeholder="Choose a role to configure permissions" />
</SelectTrigger>
<SelectContent>
<SelectItem v-for="role in roles" :key="role.id" :value="role.id">
{{ role.name }}
</SelectItem>
</SelectContent>
</Select>
</div>
<!-- Object-Level Permissions -->
<div v-if="selectedRoleId" class="space-y-2">
<h3 class="text-sm font-medium">Object-Level Permissions</h3>
<div class="rounded-md border">
<table class="w-full">
<thead>
<tr class="border-b bg-muted/50">
<th class="p-3 text-left font-medium">Permission</th>
<th class="p-3 text-center font-medium">Enabled</th>
</tr>
</thead>
<tbody>
<tr class="border-b hover:bg-muted/30">
<td class="p-3">Create</td>
<td class="p-3 text-center">
<Checkbox
:model-value="objectPermissions.canCreate"
@update:model-value="(checked: boolean) => updateObjectPermission('canCreate', checked)"
/>
</td>
</tr>
<tr class="border-b hover:bg-muted/30">
<td class="p-3">Read</td>
<td class="p-3 text-center">
<Checkbox
:model-value="objectPermissions.canRead"
@update:model-value="(checked: boolean) => updateObjectPermission('canRead', checked)"
/>
</td>
</tr>
<tr class="border-b hover:bg-muted/30">
<td class="p-3">Edit</td>
<td class="p-3 text-center">
<Checkbox
:model-value="objectPermissions.canEdit"
@update:model-value="(checked: boolean) => updateObjectPermission('canEdit', checked)"
/>
</td>
</tr>
<tr class="border-b hover:bg-muted/30">
<td class="p-3">Delete</td>
<td class="p-3 text-center">
<Checkbox
:model-value="objectPermissions.canDelete"
@update:model-value="(checked: boolean) => updateObjectPermission('canDelete', checked)"
/>
</td>
</tr>
<tr class="border-b hover:bg-muted/30">
<td class="p-3">View All</td>
<td class="p-3 text-center">
<Checkbox
:model-value="objectPermissions.canViewAll"
@update:model-value="(checked: boolean) => updateObjectPermission('canViewAll', checked)"
/>
</td>
</tr>
<tr class="hover:bg-muted/30">
<td class="p-3">Modify All</td>
<td class="p-3 text-center">
<Checkbox
:model-value="objectPermissions.canModifyAll"
@update:model-value="(checked: boolean) => updateObjectPermission('canModifyAll', checked)"
/>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<!-- Field-Level Permissions -->
<div v-if="selectedRoleId" class="space-y-2">
<h3 class="text-sm font-medium">Field-Level Permissions</h3>
<div class="rounded-md border">
<table class="w-full">
<thead>
<tr class="border-b bg-muted/50">
<th class="p-3 text-left font-medium">Field</th>
<th class="p-3 text-center font-medium">Read</th>
<th class="p-3 text-center font-medium">Edit</th>
</tr>
</thead>
<tbody>
<tr
v-for="field in fields"
:key="field.id"
class="border-b hover:bg-muted/30"
>
<td class="p-3">
<div>
<div class="font-medium">{{ field.label }}</div>
<div class="text-xs text-muted-foreground">{{ field.apiName }}</div>
</div>
</td>
<td class="p-3 text-center">
<Checkbox
:model-value="hasPermission(field.id, selectedRoleId, 'read')"
@update:model-value="(checked: boolean) => updatePermission(field.id, selectedRoleId, 'read', checked)"
:disabled="field.isSystem"
/>
</td>
<td class="p-3 text-center">
<Checkbox
:model-value="hasPermission(field.id, selectedRoleId, 'edit')"
@update:model-value="(checked: boolean) => updatePermission(field.id, selectedRoleId, 'edit', checked)"
:disabled="field.isSystem || !hasPermission(field.id, selectedRoleId, 'read')"
/>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="flex items-center gap-2 text-sm text-muted-foreground">
<Info class="h-4 w-4" />
<span>System fields are always readable. Edit permissions require read permission first. Changes save automatically.</span>
</div>
<div v-if="saving" class="flex items-center gap-2 text-sm text-primary">
<div class="animate-spin rounded-full h-4 w-4 border-b-2 border-primary"></div>
<span>Saving...</span>
</div>
</div>
</CardContent>
</Card>
</template>
<script setup lang="ts">
import { ref, onMounted, computed, watch } from 'vue';
import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '~/components/ui/card';
import { Checkbox } from '~/components/ui/checkbox';
import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '~/components/ui/select';
import { Label } from '~/components/ui/label';
import { Info } from 'lucide-vue-next';
const props = defineProps<{
objectId: string;
objectApiName: string;
fields: any[];
}>();
const { api } = useApi();
const { toast } = useToast();
const loading = ref(true);
const saving = ref(false);
const roles = ref<any[]>([]);
const selectedRoleId = ref<string>('');
const permissions = ref<Map<string, Map<string, { canRead: boolean; canEdit: boolean }>>>(new Map());
const objectPermissions = ref({
canCreate: false,
canRead: false,
canEdit: false,
canDelete: false,
canViewAll: false,
canModifyAll: false,
});
// Load roles and permissions
onMounted(async () => {
try {
loading.value = true;
// Load roles
const rolesResponse = await api.get('/setup/roles');
roles.value = rolesResponse || [];
// Load existing permissions for this object
const permsResponse = await api.get(`/setup/objects/${props.objectId}/field-permissions`);
// Build permissions map: fieldId -> roleId -> {canRead, canEdit}
const permsMap = new Map();
if (permsResponse && Array.isArray(permsResponse)) {
for (const perm of permsResponse) {
if (!permsMap.has(perm.fieldDefinitionId)) {
permsMap.set(perm.fieldDefinitionId, new Map());
}
permsMap.get(perm.fieldDefinitionId).set(perm.roleId, {
canRead: Boolean(perm.canRead),
canEdit: Boolean(perm.canEdit),
});
}
}
permissions.value = permsMap;
} catch (error: any) {
console.error('Failed to load field permissions:', error);
toast.error('Failed to load field permissions');
} finally {
loading.value = false;
}
});
const hasPermission = (fieldId: string, roleId: string, type: 'read' | 'edit'): boolean => {
const fieldPerms = permissions.value.get(fieldId);
if (!fieldPerms) return true; // Default to true if no permissions set
const rolePerm = fieldPerms.get(roleId);
if (!rolePerm) return true; // Default to true if no permissions set
const value = type === 'read' ? rolePerm.canRead : rolePerm.canEdit;
return Boolean(value); // Convert 1/0 to true/false
};
const updatePermission = async (fieldId: string, roleId: string, type: 'read' | 'edit', checked: boolean) => {
try {
saving.value = true;
// Get current permissions
if (!permissions.value.has(fieldId)) {
permissions.value.set(fieldId, new Map());
}
const fieldPerms = permissions.value.get(fieldId)!;
if (!fieldPerms.has(roleId)) {
fieldPerms.set(roleId, { canRead: true, canEdit: true });
}
const perm = fieldPerms.get(roleId)!;
// Update permission
if (type === 'read') {
perm.canRead = checked;
// If disabling read, also disable edit
if (!checked) {
perm.canEdit = false;
}
} else {
perm.canEdit = checked;
// If enabling edit, also enable read
if (checked) {
perm.canRead = true;
}
}
// Save to backend
await api.put(`/setup/objects/${props.objectId}/field-permissions`, {
roleId,
fieldDefinitionId: fieldId,
canRead: perm.canRead,
canEdit: perm.canEdit,
});
toast.success('Permission updated');
} catch (error: any) {
console.error('Failed to update field permission:', error);
toast.error(error.message || 'Failed to update permission');
// Revert change
if (!permissions.value.has(fieldId)) return;
const fieldPerms = permissions.value.get(fieldId)!;
if (!fieldPerms.has(roleId)) return;
const perm = fieldPerms.get(roleId)!;
if (type === 'read') {
perm.canRead = !checked;
} else {
perm.canEdit = !checked;
}
} finally {
saving.value = false;
}
};
const updateObjectPermission = async (permission: string, checked: boolean) => {
if (!selectedRoleId.value) return;
try {
saving.value = true;
// Update local state
(objectPermissions.value as any)[permission] = checked;
// Save to backend
await api.put(`/setup/objects/${props.objectApiName}/permissions`, {
roleId: selectedRoleId.value,
...objectPermissions.value,
});
toast.success('Object permission updated');
} catch (error: any) {
console.error('Failed to update object permission:', error);
toast.error(error.message || 'Failed to update permission');
// Revert change
(objectPermissions.value as any)[permission] = !checked;
} finally {
saving.value = false;
}
};
// Load object permissions when role changes
watch(selectedRoleId, async (roleId) => {
if (!roleId) return;
try {
const response = await api.get(`/setup/objects/${props.objectApiName}/permissions/${roleId}`);
if (response) {
objectPermissions.value = {
canCreate: Boolean(response.canCreate),
canRead: Boolean(response.canRead),
canEdit: Boolean(response.canEdit),
canDelete: Boolean(response.canDelete),
canViewAll: Boolean(response.canViewAll),
canModifyAll: Boolean(response.canModifyAll),
};
}
} catch (error: any) {
console.error('Failed to load object permissions:', error);
}
});
</script>

345
frontend/components/ObjectAccessSettings.vue
View File

@@ -1,262 +1,119 @@
<template>
<div class="space-y-6">
<div v-if="loading" class="text-center py-8">Loading access settings...</div>
<Card>
<CardHeader>
<CardTitle>Org-Wide Default</CardTitle>
<CardDescription>
Control the baseline visibility for records of this object
</CardDescription>
</CardHeader>
<CardContent class="space-y-4">
<div class="space-y-2">
<Label for="orgWideDefault">Record Visibility</Label>
<Select v-model="localOrgWideDefault" @update:model-value="handleOrgWideDefaultChange">
<SelectTrigger id="orgWideDefault">
<SelectValue placeholder="Select visibility level" />
</SelectTrigger>
<SelectContent>
<SelectItem value="private">
<div>
<div class="font-semibold">Private</div>
<div class="text-xs text-muted-foreground">Only record owner can see</div>
</div>
</SelectItem>
<SelectItem value="public_read">
<div>
<div class="font-semibold">Public Read Only</div>
<div class="text-xs text-muted-foreground">Everyone can read, only owner can edit/delete</div>
</div>
</SelectItem>
<SelectItem value="public_read_write">
<div>
<div class="font-semibold">Public Read/Write</div>
<div class="text-xs text-muted-foreground">Everyone can read, edit, and delete all records</div>
</div>
</SelectItem>
</SelectContent>
</Select>
<p class="text-sm text-muted-foreground">
This setting controls who can see records by default. Individual user permissions are granted through roles.
</p>
</div>
</CardContent>
</Card>
<FieldLevelSecurity
v-if="objectId && objectApiName && fields && fields.length > 0"
:object-id="objectId"
:object-api-name="objectApiName"
:fields="fields"
/>
<div v-else class="space-y-6">
<!-- Global Access Model -->
<Card>
<CardHeader>
<CardTitle>Global Access Model</CardTitle>
<CardDescription>
Define the default access control model for this object
</CardDescription>
</CardHeader>
<CardContent class="space-y-4">
<div class="space-y-2">
<Label>Access Model</Label>
<Select v-model="accessModel">
<SelectTrigger>
<SelectValue placeholder="Select access model" />
</SelectTrigger>
<SelectContent>
<SelectItem value="public">Public - Anyone can access</SelectItem>
<SelectItem value="owner">Owner Only - Only record owner can access</SelectItem>
<SelectItem value="mixed">Mixed - Owner plus role/share-based access</SelectItem>
</SelectContent>
</Select>
<p class="text-sm text-muted-foreground">
<span v-if="accessModel === 'public'">
All users can access records by default
</span>
<span v-else-if="accessModel === 'owner'">
Only the record owner can access records
</span>
<span v-else-if="accessModel === 'mixed'">
Record owner has access, plus role-based and sharing rules apply
</span>
</p>
</div>
<div class="space-y-2">
<Label>Owner Field</Label>
<Input v-model="ownerField" placeholder="ownerId" />
<p class="text-sm text-muted-foreground">
The field name that stores the record owner's ID
</p>
</div>
<div class="space-y-3">
<Label>Public Permissions</Label>
<div class="space-y-2">
<div class="flex items-center space-x-2">
<Checkbox
id="public-read"
v-model:checked="publicRead"
/>
<Label for="public-read" class="cursor-pointer font-normal">Public Read</Label>
</div>
<div class="flex items-center space-x-2">
<Checkbox
id="public-create"
v-model:checked="publicCreate"
/>
<Label for="public-create" class="cursor-pointer font-normal">Public Create</Label>
</div>
<div class="flex items-center space-x-2">
<Checkbox
id="public-update"
v-model:checked="publicUpdate"
/>
<Label for="public-update" class="cursor-pointer font-normal">Public Update</Label>
</div>
<div class="flex items-center space-x-2">
<Checkbox
id="public-delete"
v-model:checked="publicDelete"
/>
<Label for="public-delete" class="cursor-pointer font-normal">Public Delete</Label>
</div>
</div>
</div>
</CardContent>
</Card>
<!-- Field-Level Permissions -->
<Card>
<CardHeader>
<CardTitle>Field-Level Permissions</CardTitle>
<CardDescription>
Set default read/write permissions for individual fields
</CardDescription>
</CardHeader>
<CardContent>
<div class="space-y-2">
<div
v-for="field in fields"
:key="field.apiName"
class="flex items-center justify-between p-3 border rounded-lg"
>
<div class="flex-1">
<div class="font-medium">{{ field.label }}</div>
<div class="text-sm text-muted-foreground">{{ field.apiName }}</div>
</div>
<div class="flex items-center gap-4">
<div class="flex items-center space-x-2">
<Checkbox
:id="`${field.apiName}-read`"
:checked="getFieldPermission(field.apiName, 'read')"
@update:checked="(val) => setFieldPermission(field.apiName, 'read', val)"
/>
<Label :for="`${field.apiName}-read`" class="cursor-pointer">Read</Label>
</div>
<div class="flex items-center space-x-2">
<Checkbox
:id="`${field.apiName}-write`"
:checked="getFieldPermission(field.apiName, 'write')"
@update:checked="(val) => setFieldPermission(field.apiName, 'write', val)"
/>
<Label :for="`${field.apiName}-write`" class="cursor-pointer">Write</Label>
</div>
</div>
</div>
</div>
</CardContent>
</Card>
<!-- Save Button -->
<div class="flex justify-end">
<Button @click="saveChanges" :disabled="saving">
{{ saving ? 'Saving...' : 'Save Changes' }}
</Button>
</div>
<div v-else-if="!objectId" class="text-sm text-muted-foreground">
Object ID not available
</div>
<div v-else-if="!fields || fields.length === 0" class="text-sm text-muted-foreground">
No fields available
</div>
</div>
</template>
<script setup lang="ts">
import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card'
import { Button } from '@/components/ui/button'
import { Input } from '@/components/ui/input'
import { Label } from '@/components/ui/label'
import { Checkbox } from '@/components/ui/checkbox'
import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select'
import { ref, watch } from 'vue';
import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '~/components/ui/card';
import { Label } from '~/components/ui/label';
import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '~/components/ui/select';
import FieldLevelSecurity from '~/components/FieldLevelSecurity.vue';
interface Props {
objectApiName: string
fields: any[]
}
const props = defineProps<{
objectApiName: string;
objectId?: string;
orgWideDefault?: string;
fields?: any[];
}>();
const props = defineProps<Props>()
const emit = defineEmits(['updated'])
const emit = defineEmits<{
update: [orgWideDefault: string];
}>();
const { api } = useApi()
const { toast } = useToast()
const { $api } = useNuxtApp();
const { showToast } = useToast();
const loading = ref(true)
const saving = ref(false)
const localOrgWideDefault = ref(props.orgWideDefault || 'private');
const accessModel = ref<string>('owner')
const publicRead = ref<boolean>(false)
const publicCreate = ref<boolean>(false)
const publicUpdate = ref<boolean>(false)
const publicDelete = ref<boolean>(false)
const ownerField = ref<string>('ownerId')
// Watch for prop changes
watch(() => props.orgWideDefault, (newValue) => {
if (newValue) {
localOrgWideDefault.value = newValue;
}
});
const fieldPermissions = ref<Record<string, { defaultReadable: boolean; defaultWritable: boolean }>>({})
const fetchAccessConfig = async () => {
const handleOrgWideDefaultChange = async (value: string) => {
try {
loading.value = true
const data = await api.get(`/setup/objects/${props.objectApiName}/access`)
accessModel.value = data.accessModel || 'owner'
publicRead.value = Boolean(data.publicRead)
publicCreate.value = Boolean(data.publicCreate)
publicUpdate.value = Boolean(data.publicUpdate)
publicDelete.value = Boolean(data.publicDelete)
ownerField.value = data.ownerField || 'ownerId'
// Update object definition
await $api(`/api/setup/objects/${props.objectApiName}`, {
method: 'PATCH',
body: {
orgWideDefault: value
}
});
// Initialize field permissions from field definitions
fieldPermissions.value = {}
if (data.fields && data.fields.length > 0) {
data.fields.forEach((field: any) => {
fieldPermissions.value[field.apiName] = {
defaultReadable: Boolean(field.defaultReadable ?? true),
defaultWritable: Boolean(field.defaultWritable ?? true),
}
})
} else {
// Initialize all fields with default permissions
props.fields.forEach((field) => {
fieldPermissions.value[field.apiName] = {
defaultReadable: true,
defaultWritable: true,
}
})
}
} catch (e: any) {
console.error('Error fetching access config:', e)
toast.error('Failed to load access settings')
} finally {
loading.value = false
showToast({
title: 'Success',
description: 'Org-Wide Default saved successfully',
variant: 'default'
});
emit('update', value);
} catch (error: any) {
console.error('Failed to update org-wide default:', error);
showToast({
title: 'Error',
description: error.data?.message || 'Failed to save changes',
variant: 'destructive'
});
}
}
const getFieldPermission = (fieldKey: string, type: 'read' | 'write'): boolean => {
const perms = fieldPermissions.value[fieldKey]
if (!perms) return true
const value = type === 'read' ? perms.defaultReadable : perms.defaultWritable
return Boolean(value)
}
const setFieldPermission = (fieldKey: string, type: 'read' | 'write', value: boolean) => {
if (!fieldPermissions.value[fieldKey]) {
fieldPermissions.value[fieldKey] = { defaultReadable: true, defaultWritable: true }
}
if (type === 'read') {
fieldPermissions.value[fieldKey].defaultReadable = Boolean(value)
} else {
fieldPermissions.value[fieldKey].defaultWritable = Boolean(value)
}
}
const saveChanges = async () => {
try {
saving.value = true
// Ensure all values are proper booleans
const payload = {
accessModel: accessModel.value,
publicRead: Boolean(publicRead.value),
publicCreate: Boolean(publicCreate.value),
publicUpdate: Boolean(publicUpdate.value),
publicDelete: Boolean(publicDelete.value),
ownerField: ownerField.value,
}
// Update global access config
await api.put(`/setup/objects/${props.objectApiName}/access`, payload)
// Update field permissions
const fieldPermsArray = Object.entries(fieldPermissions.value).map(([fieldKey, perms]) => ({
fieldKey,
defaultReadable: perms.defaultReadable,
defaultWritable: perms.defaultWritable,
}))
await api.put(`/setup/objects/${props.objectApiName}/field-permissions`, fieldPermsArray)
toast.success('Access settings saved successfully')
emit('updated')
} catch (e: any) {
console.error('Error saving access config:', e)
toast.error('Failed to save access settings')
} finally {
saving.value = false
}
}
onMounted(() => {
fetchAccessConfig()
})
};
</script>

284
frontend/components/RecordShareDialog.vue
View File

@@ -1,284 +0,0 @@
<template>
<Dialog :open="open" @update:open="handleClose">
<DialogContent class="max-w-2xl">
<DialogHeader>
<DialogTitle>Share Record</DialogTitle>
<DialogDescription>
Grant access to this record to other users
</DialogDescription>
</DialogHeader>
<div class="space-y-6 py-4">
<!-- Existing Shares -->
<div v-if="shares.length > 0" class="space-y-3">
<h3 class="text-sm font-semibold">Current Shares</h3>
<div
v-for="share in shares"
:key="share.id"
class="flex items-center justify-between p-3 border rounded-lg"
>
<div class="flex-1">
<div class="font-medium">{{ share.granteeUser?.email || 'Unknown User' }}</div>
<div class="text-sm text-muted-foreground">
Permissions: {{ share.actions.join(', ') }}
<span v-if="share.fields">(Limited fields)</span>
</div>
<div v-if="share.expiresAt" class="text-xs text-muted-foreground">
Expires: {{ formatDate(share.expiresAt) }}
</div>
</div>
<Button
variant="ghost"
size="sm"
@click="handleRevokeShare(share.id)"
>
<X class="w-4 h-4" />
</Button>
</div>
</div>
<!-- Add New Share Form -->
<div class="space-y-4 border-t pt-4">
<h3 class="text-sm font-semibold">Add New Share</h3>
<div class="space-y-2">
<Label>User Email</Label>
<Input
v-model="newShare.userEmail"
placeholder="user@example.com"
type="email"
/>
</div>
<div class="space-y-2">
<Label>Permissions</Label>
<div class="space-y-2">
<div class="flex items-center space-x-2">
<Checkbox
id="perm-read"
:checked="newShare.permissions.read"
@update:checked="(val) => newShare.permissions.read = val"
/>
<Label for="perm-read" class="cursor-pointer">Read</Label>
</div>
<div class="flex items-center space-x-2">
<Checkbox
id="perm-update"
:checked="newShare.permissions.update"
@update:checked="(val) => newShare.permissions.update = val"
/>
<Label for="perm-update" class="cursor-pointer">Update</Label>
</div>
</div>
</div>
<div class="space-y-2">
<div class="flex items-center space-x-2">
<Checkbox
id="field-scoped"
:checked="newShare.fieldScoped"
@update:checked="(val) => newShare.fieldScoped = val"
/>
<Label for="field-scoped" class="cursor-pointer">Limit to specific fields</Label>
</div>
<div v-if="newShare.fieldScoped" class="ml-6 space-y-2 border-l-2 pl-4">
<Label class="text-sm">Select Fields</Label>
<div class="space-y-1 max-h-48 overflow-y-auto">
<div
v-for="field in fields"
:key="field.apiName"
class="flex items-center space-x-2"
>
<Checkbox
:id="`field-${field.apiName}`"
:checked="newShare.selectedFields.includes(field.apiName)"
@update:checked="(val) => handleFieldToggle(field.apiName, val)"
/>
<Label :for="`field-${field.apiName}`" class="cursor-pointer text-sm">
{{ field.label }}
</Label>
</div>
</div>
</div>
</div>
<div class="space-y-2">
<div class="flex items-center space-x-2">
<Checkbox
id="has-expiry"
:checked="newShare.hasExpiry"
@update:checked="(val) => newShare.hasExpiry = val"
/>
<Label for="has-expiry" class="cursor-pointer">Set expiration date</Label>
</div>
<Input
v-if="newShare.hasExpiry"
v-model="newShare.expiryDate"
type="datetime-local"
class="ml-6"
/>
</div>
</div>
</div>
<DialogFooter>
<Button variant="outline" @click="handleClose">Cancel</Button>
<Button @click="handleAddShare" :disabled="!canAddShare || saving">
{{ saving ? 'Sharing...' : 'Share' }}
</Button>
</DialogFooter>
</DialogContent>
</Dialog>
</template>
<script setup lang="ts">
import { X } from 'lucide-vue-next'
import {
Dialog,
DialogContent,
DialogDescription,
DialogFooter,
DialogHeader,
DialogTitle,
} from '@/components/ui/dialog'
import { Button } from '@/components/ui/button'
import { Input } from '@/components/ui/input'
import { Label } from '@/components/ui/label'
import { Checkbox } from '@/components/ui/checkbox'
interface Props {
open: boolean
objectDefinitionId: string
recordId: string
fields?: any[]
}
const props = withDefaults(defineProps<Props>(), {
fields: () => []
})
const emit = defineEmits(['close', 'shared'])
const { api } = useApi()
const { toast } = useToast()
const shares = ref<any[]>([])
const loading = ref(false)
const saving = ref(false)
const newShare = ref({
userEmail: '',
permissions: {
read: true,
update: false,
},
fieldScoped: false,
selectedFields: [] as string[],
hasExpiry: false,
expiryDate: '',
})
const canAddShare = computed(() => {
return newShare.value.userEmail && (newShare.value.permissions.read || newShare.value.permissions.update)
})
const fetchShares = async () => {
try {
loading.value = true
shares.value = await api.get(`/shares/record/${props.objectDefinitionId}/${props.recordId}`)
} catch (e: any) {
console.error('Error fetching shares:', e)
} finally {
loading.value = false
}
}
const handleFieldToggle = (fieldKey: string, checked: boolean) => {
if (checked) {
if (!newShare.value.selectedFields.includes(fieldKey)) {
newShare.value.selectedFields.push(fieldKey)
}
} else {
newShare.value.selectedFields = newShare.value.selectedFields.filter(f => f !== fieldKey)
}
}
const handleAddShare = async () => {
try {
saving.value = true
// First, find user by email (you'll need an endpoint for this)
// For now, we'll assume the email is actually a user ID
const actions = []
if (newShare.value.permissions.read) actions.push('read')
if (newShare.value.permissions.update) actions.push('update')
const payload: any = {
objectDefinitionId: props.objectDefinitionId,
recordId: props.recordId,
granteeUserId: newShare.value.userEmail, // Should be user ID, not email
actions,
}
if (newShare.value.fieldScoped && newShare.value.selectedFields.length > 0) {
payload.fields = newShare.value.selectedFields
}
if (newShare.value.hasExpiry && newShare.value.expiryDate) {
payload.expiresAt = new Date(newShare.value.expiryDate).toISOString()
}
await api.post('/shares', payload)
toast.success('Record shared successfully')
await fetchShares()
// Reset form
newShare.value = {
userEmail: '',
permissions: { read: true, update: false },
fieldScoped: false,
selectedFields: [],
hasExpiry: false,
expiryDate: '',
}
emit('shared')
} catch (e: any) {
console.error('Error creating share:', e)
toast.error('Failed to share record')
} finally {
saving.value = false
}
}
const handleRevokeShare = async (shareId: string) => {
if (!confirm('Are you sure you want to revoke this share?')) return
try {
await api.delete(`/shares/${shareId}`)
toast.success('Share revoked successfully')
await fetchShares()
emit('shared')
} catch (e: any) {
console.error('Error revoking share:', e)
toast.error('Failed to revoke share')
}
}
const formatDate = (date: string) => {
return new Date(date).toLocaleDateString()
}
const handleClose = () => {
emit('close')
}
watch(() => props.open, (isOpen) => {
if (isOpen) {
fetchShares()
}
})
</script>

373
frontend/components/RecordShareManager.vue
View File

@@ -1,373 +0,0 @@
<template>
<div class="space-y-4">
<!-- Existing Shares List -->
<Card>
<CardHeader>
<CardTitle>Current Shares</CardTitle>
<CardDescription>Users who have access to this record</CardDescription>
</CardHeader>
<CardContent>
<div v-if="loading" class="flex justify-center py-8">
<div class="animate-spin h-8 w-8 border-4 border-primary border-t-transparent rounded-full"></div>
</div>
<div v-else-if="shares.length === 0" class="text-center py-8 text-muted-foreground">
No shares yet. Click "Add Share" to share this record.
</div>
<div v-else class="space-y-2">
<div
v-for="share in shares"
:key="share.id"
class="flex items-center justify-between p-3 border rounded-lg"
>
<div class="flex-1">
<div class="font-medium">{{ getUserName(share.granteeUser) }}</div>
<div class="text-sm text-muted-foreground">
Access: {{ formatActions(share.actions) }}
<span v-if="share.fields && share.fields.length > 0">
• Fields: {{ share.fields.join(', ') }}
</span>
<span v-if="share.expiresAt">
• Expires: {{ formatDate(share.expiresAt) }}
</span>
</div>
<div class="text-xs text-muted-foreground mt-1">
Granted by {{ getUserName(share.grantedByUser) }}
on {{ formatDate(share.createdAt) }}
</div>
</div>
<Button
variant="ghost"
size="sm"
@click="revokeShare(share.id)"
:disabled="revoking === share.id"
>
<Trash2 class="h-4 w-4" />
</Button>
</div>
</div>
</CardContent>
</Card>
<!-- Add New Share -->
<Card>
<CardHeader>
<CardTitle>Add Share</CardTitle>
<CardDescription>Grant access to another user</CardDescription>
</CardHeader>
<CardContent class="space-y-4">
<!-- User Selection -->
<div class="space-y-2">
<Label for="user">User</Label>
<select
id="user"
v-model="newShare.userId"
class="w-full px-3 py-2 border rounded-md bg-background"
>
<option value="">Select a user</option>
<option
v-for="user in availableUsers"
:key="user.id"
:value="user.id"
>
{{ user.name }}
</option>
</select>
</div>
<!-- Access Level -->
<div class="space-y-2">
<Label>Access Level</Label>
<div class="space-y-2">
<div class="flex items-center space-x-2">
<input
type="checkbox"
id="share-read"
v-model="newShare.canRead"
:disabled="!canGrantRead"
class="rounded border-gray-300"
/>
<Label
for="share-read"
class="font-normal cursor-pointer"
:class="{ 'text-muted-foreground': !canGrantRead }"
>
Read
<span v-if="!canGrantRead" class="text-xs">(You don't have read permission)</span>
</Label>
</div>
<div class="flex items-center space-x-2">
<input
type="checkbox"
id="share-update"
v-model="newShare.canUpdate"
:disabled="!canGrantUpdate"
class="rounded border-gray-300"
/>
<Label
for="share-update"
class="font-normal cursor-pointer"
:class="{ 'text-muted-foreground': !canGrantUpdate }"
>
Update
<span v-if="!canGrantUpdate" class="text-xs">(You don't have update permission)</span>
</Label>
</div>
<div class="flex items-center space-x-2">
<input
type="checkbox"
id="share-delete"
v-model="newShare.canDelete"
:disabled="!canGrantDelete"
class="rounded border-gray-300"
/>
<Label
for="share-delete"
class="font-normal cursor-pointer"
:class="{ 'text-muted-foreground': !canGrantDelete }"
>
Delete
<span v-if="!canGrantDelete" class="text-xs">(You don't have delete permission)</span>
</Label>
</div>
</div>
</div>
<!-- Field-Level Access (Optional) -->
<div class="space-y-2">
<div class="flex items-center space-x-2">
<input
type="checkbox"
id="limit-fields"
v-model="newShare.limitFields"
class="rounded border-gray-300"
/>
<Label for="limit-fields" class="font-normal cursor-pointer">
Limit access to specific fields
</Label>
</div>
<div v-if="newShare.limitFields" class="ml-6 space-y-2 mt-2">
<Label>Select Fields</Label>
<div class="space-y-1 max-h-48 overflow-y-auto border rounded p-2">
<div
v-for="field in availableFields"
:key="field.apiName"
class="flex items-center space-x-2"
>
<input
type="checkbox"
:id="`field-${field.apiName}`"
:value="field.apiName"
v-model="newShare.selectedFields"
class="rounded border-gray-300"
/>
<Label :for="`field-${field.apiName}`" class="font-normal cursor-pointer">
{{ field.label }}
</Label>
</div>
</div>
</div>
</div>
<!-- Expiration (Optional) -->
<div class="space-y-2">
<div class="flex items-center space-x-2">
<input
type="checkbox"
id="set-expiration"
v-model="newShare.hasExpiration"
class="rounded border-gray-300"
/>
<Label for="set-expiration" class="font-normal cursor-pointer">
Set expiration date
</Label>
</div>
<div v-if="newShare.hasExpiration" class="ml-6">
<input
type="datetime-local"
v-model="newShare.expiresAt"
class="w-full px-3 py-2 border rounded-md bg-background"
/>
</div>
</div>
<Button
@click="createShare"
:disabled="!canCreateShare || creating"
class="w-full"
>
<Share2 class="h-4 w-4 mr-2" />
{{ creating ? 'Creating...' : 'Add Share' }}
</Button>
</CardContent>
</Card>
</div>
</template>
<script setup lang="ts">
import { ref, computed, onMounted } from 'vue'
import { Share2, Trash2 } from 'lucide-vue-next'
import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card'
import { Button } from '@/components/ui/button'
import { Label } from '@/components/ui/label'
import { useApi } from '@/composables/useApi'
import { useToast } from '@/composables/useToast'
interface Props {
objectApiName: string
recordId: string
currentUserPermissions: {
canRead: boolean
canUpdate: boolean
canDelete: boolean
}
fields: Array<{ apiName: string; label: string }>
}
const props = defineProps<Props>()
const { api } = useApi()
const { showToast } = useToast()
const shares = ref<any[]>([])
const loading = ref(true)
const revoking = ref<string | null>(null)
const creating = ref(false)
const availableUsers = ref<any[]>([])
const newShare = ref({
userId: '',
canRead: true,
canUpdate: false,
canDelete: false,
limitFields: false,
selectedFields: [] as string[],
hasExpiration: false,
expiresAt: ''
})
const canGrantRead = computed(() => props.currentUserPermissions.canRead)
const canGrantUpdate = computed(() => props.currentUserPermissions.canUpdate)
const canGrantDelete = computed(() => props.currentUserPermissions.canDelete)
const availableFields = computed(() => {
return props.fields.filter(f => !['id', 'created_at', 'updated_at', 'ownerId'].includes(f.apiName))
})
const canCreateShare = computed(() => {
return newShare.value.userId &&
(newShare.value.canRead || newShare.value.canUpdate || newShare.value.canDelete)
})
const getUserName = (user: any) => {
if (!user) return 'Unknown'
return user.name || user.email || 'Unknown'
}
const formatActions = (actions: string[]) => {
return actions.map(a => a.charAt(0).toUpperCase() + a.slice(1)).join(', ')
}
const formatDate = (date: string) => {
return new Date(date).toLocaleDateString('en-US', {
year: 'numeric',
month: 'short',
day: 'numeric',
hour: '2-digit',
minute: '2-digit'
})
}
const fetchShares = async () => {
loading.value = true
try {
const response = await api.get(`/rbac/shares/${props.objectApiName}/${props.recordId}`)
shares.value = response
} catch (error) {
console.error('Failed to fetch shares:', error)
showToast('Failed to load shares', 'error')
} finally {
loading.value = false
}
}
const fetchAvailableUsers = async () => {
try {
const response = await api.get('/rbac/users')
availableUsers.value = response
} catch (error) {
console.error('Failed to fetch users:', error)
}
}
const createShare = async () => {
creating.value = true
try {
const actions: string[] = []
if (newShare.value.canRead) actions.push('read')
if (newShare.value.canUpdate) actions.push('update')
if (newShare.value.canDelete) actions.push('delete')
const payload: any = {
objectApiName: props.objectApiName,
recordId: props.recordId,
granteeUserId: newShare.value.userId,
actions
}
if (newShare.value.limitFields && newShare.value.selectedFields.length > 0) {
payload.fields = newShare.value.selectedFields
}
if (newShare.value.hasExpiration && newShare.value.expiresAt) {
payload.expiresAt = new Date(newShare.value.expiresAt).toISOString()
}
await api.post('/rbac/shares', payload)
showToast('Share created successfully', 'success')
// Reset form
newShare.value = {
userId: '',
canRead: true,
canUpdate: false,
canDelete: false,
limitFields: false,
selectedFields: [],
hasExpiration: false,
expiresAt: ''
}
await fetchShares()
} catch (error: any) {
console.error('Failed to create share:', error)
showToast(error.message || 'Failed to create share', 'error')
} finally {
creating.value = false
}
}
const revokeShare = async (shareId: string) => {
if (!confirm('Are you sure you want to revoke this share?')) return
revoking.value = shareId
try {
await api.delete(`/rbac/shares/${shareId}`)
showToast('Share revoked successfully', 'success')
await fetchShares()
} catch (error: any) {
console.error('Failed to revoke share:', error)
showToast(error.message || 'Failed to revoke share', 'error')
} finally {
revoking.value = null
}
}
onMounted(() => {
fetchShares()
fetchAvailableUsers()
})
</script>

265
frontend/components/RolePermissionsEditor.vue
View File

@@ -1,265 +0,0 @@
<template>
<div class="space-y-6">
<div v-if="loading" class="text-center py-8">Loading...</div>
<div v-else class="space-y-6">
<!-- Object Permissions -->
<div
v-for="obj in objects"
:key="obj.id"
class="border rounded-lg p-4 space-y-3"
>
<div class="flex items-center justify-between">
<h3 class="font-semibold">{{ obj.label }}</h3>
<Button
variant="ghost"
size="sm"
@click="toggleObjectExpanded(obj.id)"
>
{{ expandedObjects[obj.id] ? 'Collapse' : 'Expand' }}
</Button>
</div>
<div v-if="expandedObjects[obj.id]" class="space-y-4">
<!-- CRUD Permissions -->
<div class="grid grid-cols-2 gap-3">
<div class="flex items-center space-x-2">
<Checkbox
:id="`${obj.id}-read`"
:checked="hasPermission(obj.apiName, 'read')"
@update:checked="(val) => setPermission(obj.apiName, 'read', val)"
/>
<Label :for="`${obj.id}-read`" class="cursor-pointer">Read</Label>
</div>
<div class="flex items-center space-x-2">
<Checkbox
:id="`${obj.id}-create`"
:checked="hasPermission(obj.apiName, 'create')"
@update:checked="(val) => setPermission(obj.apiName, 'create', val)"
/>
<Label :for="`${obj.id}-create`" class="cursor-pointer">Create</Label>
</div>
<div class="flex items-center space-x-2">
<Checkbox
:id="`${obj.id}-update`"
:checked="hasPermission(obj.apiName, 'update')"
@update:checked="(val) => setPermission(obj.apiName, 'update', val)"
/>
<Label :for="`${obj.id}-update`" class="cursor-pointer">Update</Label>
</div>
<div class="flex items-center space-x-2">
<Checkbox
:id="`${obj.id}-delete`"
:checked="hasPermission(obj.apiName, 'delete')"
@update:checked="(val) => setPermission(obj.apiName, 'delete', val)"
/>
<Label :for="`${obj.id}-delete`" class="cursor-pointer">Delete</Label>
</div>
</div>
<!-- Advanced: Condition-based permissions -->
<div class="border-t pt-3">
<div class="flex items-center space-x-2 mb-2">
<Checkbox
:id="`${obj.id}-conditions`"
:checked="hasConditions(obj.apiName)"
@update:checked="(val) => toggleConditions(obj.apiName, val)"
/>
<Label :for="`${obj.id}-conditions`" class="cursor-pointer text-sm">
Apply conditions (e.g., own records only)
</Label>
</div>
<div v-if="hasConditions(obj.apiName)" class="ml-6 space-y-2">
<div class="text-sm text-muted-foreground">
Only allow access to records where:
</div>
<div class="flex gap-2">
<Input
v-model="getConditions(obj.apiName).field"
placeholder="Field name (e.g., ownerId)"
class="flex-1"
/>
<Input
v-model="getConditions(obj.apiName).value"
placeholder="Value (e.g., $userId)"
class="flex-1"
/>
</div>
</div>
</div>
</div>
</div>
<!-- Save Button -->
<div class="flex justify-end gap-2">
<Button variant="outline" @click="$emit('cancel')">Cancel</Button>
<Button @click="savePermissions" :disabled="saving">
{{ saving ? 'Saving...' : 'Save Permissions' }}
</Button>
</div>
</div>
</div>
</template>
<script setup lang="ts">
import { Button } from '@/components/ui/button'
import { Input } from '@/components/ui/input'
import { Label } from '@/components/ui/label'
import { Checkbox } from '@/components/ui/checkbox'
interface Props {
role: any
}
const props = defineProps<Props>()
const emit = defineEmits(['saved', 'cancel'])
const { api } = useApi()
const { toast } = useToast()
const loading = ref(true)
const saving = ref(false)
const objects = ref<any[]>([])
const expandedObjects = ref<Record<string, boolean>>({})
// Store permissions as CASL-like rules
const permissions = ref<Record<string, {
actions: string[]
conditions?: any
}>>({})
const fetchObjects = async () => {
try {
loading.value = true
objects.value = await api.get('/setup/objects')
// Expand all objects by default
objects.value.forEach(obj => {
expandedObjects.value[obj.id] = true
})
} catch (e: any) {
console.error('Error fetching objects:', e)
} finally {
loading.value = false
}
}
const fetchRolePermissions = async () => {
try {
const rules = await api.get(`/role-rules/role/${props.role.id}`)
// Parse existing rules into our format
if (rules && rules.length > 0 && rules[0].rulesJson) {
const rulesJson = rules[0].rulesJson
rulesJson.forEach((rule: any) => {
if (!permissions.value[rule.subject]) {
permissions.value[rule.subject] = { actions: [] }
}
if (Array.isArray(rule.action)) {
permissions.value[rule.subject].actions.push(...rule.action)
} else {
permissions.value[rule.subject].actions.push(rule.action)
}
if (rule.conditions) {
permissions.value[rule.subject].conditions = rule.conditions
}
})
}
} catch (e: any) {
console.error('Error fetching role permissions:', e)
}
}
const toggleObjectExpanded = (objectId: string) => {
expandedObjects.value[objectId] = !expandedObjects.value[objectId]
}
const hasPermission = (subject: string, action: string): boolean => {
return permissions.value[subject]?.actions.includes(action) || false
}
const setPermission = (subject: string, action: string, value: boolean) => {
if (!permissions.value[subject]) {
permissions.value[subject] = { actions: [] }
}
if (value) {
if (!permissions.value[subject].actions.includes(action)) {
permissions.value[subject].actions.push(action)
}
} else {
permissions.value[subject].actions = permissions.value[subject].actions.filter(a => a !== action)
}
}
const hasConditions = (subject: string): boolean => {
return !!permissions.value[subject]?.conditions
}
const toggleConditions = (subject: string, value: boolean) => {
if (!permissions.value[subject]) {
permissions.value[subject] = { actions: [] }
}
if (value) {
permissions.value[subject].conditions = { field: 'ownerId', value: '$userId' }
} else {
delete permissions.value[subject].conditions
}
}
const getConditions = (subject: string) => {
if (!permissions.value[subject]?.conditions) {
return { field: '', value: '' }
}
const cond = permissions.value[subject].conditions
// Convert CASL condition format to simple field/value
const field = Object.keys(cond)[0] || ''
const value = cond[field] || ''
return { field, value }
}
const savePermissions = async () => {
try {
saving.value = true
// Convert our permission structure to CASL rules format
const rules: any[] = []
Object.entries(permissions.value).forEach(([subject, perm]) => {
if (perm.actions.length > 0) {
const rule: any = {
action: perm.actions,
subject,
}
if (perm.conditions) {
const cond = getConditions(subject)
if (cond.field && cond.value) {
rule.conditions = { [cond.field]: cond.value }
}
}
rules.push(rule)
}
})
await api.post('/role-rules', {
roleId: props.role.id,
rulesJson: rules,
})
emit('saved')
} catch (e: any) {
console.error('Error saving permissions:', e)
toast.error('Failed to save permissions')
} finally {
saving.value = false
}
}
onMounted(async () => {
await fetchObjects()
await fetchRolePermissions()
})
</script>

73
frontend/components/ui/checkbox/Checkbox.vue
View File

@@ -1,59 +1,30 @@
<script setup lang="ts">
import { computed } from 'vue'
import type { HTMLAttributes } from 'vue'
import { Check } from 'lucide-vue-next'
import { cn } from '@/lib/utils'
import type { CheckboxRootEmits, CheckboxRootProps } from "reka-ui"
import type { HTMLAttributes } from "vue"
import { reactiveOmit } from "@vueuse/core"
import { Check } from "lucide-vue-next"
import { CheckboxIndicator, CheckboxRoot, useForwardPropsEmits } from "reka-ui"
import { cn } from "@/lib/utils"
interface Props {
checked?: boolean
disabled?: boolean
required?: boolean
name?: string
value?: string
id?: string
class?: HTMLAttributes['class']
}
const props = defineProps<CheckboxRootProps & { class?: HTMLAttributes["class"] }>()
const emits = defineEmits<CheckboxRootEmits>()
const props = withDefaults(defineProps<Props>(), {
checked: false,
disabled: false,
required: false,
})
const delegatedProps = reactiveOmit(props, "class")
const emit = defineEmits<{
'update:checked': [value: boolean]
}>()
const handleChange = (event: Event) => {
const target = event.target as HTMLInputElement
emit('update:checked', target.checked)
}
const forwarded = useForwardPropsEmits(delegatedProps, emits)
</script>
<template>
<div class="relative inline-flex items-center">
<input
type="checkbox"
:id="props.id"
:checked="props.checked"
:disabled="props.disabled"
:required="props.required"
:name="props.name"
:value="props.value"
@change="handleChange"
:class="
cn(
'peer h-4 w-4 shrink-0 rounded-sm border border-primary shadow focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 cursor-pointer',
'appearance-none bg-background',
'checked:bg-primary checked:border-primary',
props.class
)
"
/>
<Check
v-if="props.checked"
class="absolute h-4 w-4 text-primary-foreground pointer-events-none"
:class="{ 'opacity-50': props.disabled }"
/>
</div>
<CheckboxRoot
v-bind="forwarded"
:class="
cn('grid place-content-center peer h-4 w-4 shrink-0 rounded-sm border border-primary shadow focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 data-[state=checked]:bg-primary data-[state=checked]:text-primary-foreground',
props.class)"
>
<CheckboxIndicator class="grid place-content-center text-current">
<slot>
<Check class="h-4 w-4" />
</slot>
</CheckboxIndicator>
</CheckboxRoot>
</template>

23
frontend/components/views/EditView.vue
View File

@@ -12,8 +12,6 @@ import {
CollapsibleTrigger,
} from '@/components/ui/collapsible'
console.log('[EditView] COMPONENT MOUNTING')
interface Props {
config: EditViewConfig
data?: any
@@ -27,8 +25,6 @@ const props = withDefaults(defineProps<Props>(), {
saving: false,
})
console.log('[EditView] Props received on mount:', JSON.stringify(props, null, 2))
const emit = defineEmits<{
'save': [data: any]
'cancel': []
@@ -39,16 +35,10 @@ const emit = defineEmits<{
const formData = ref<Record<string, any>>({ ...props.data })
const errors = ref<Record<string, string>>({})
console.log('[EditView] Initial props.data:', JSON.stringify(props.data, null, 2))
console.log('[EditView] props.data.id:', props.data?.id)
// Watch for data changes (useful for edit mode)
watch(() => props.data, (newData) => {
console.log('[EditView] Data changed:', JSON.stringify(newData, null, 2))
console.log('[EditView] newData.id:', newData?.id)
console.log('[EditView] Keys in newData:', Object.keys(newData))
formData.value = { ...newData }
}, { deep: true, immediate: true })
}, { deep: true })
// Organize fields into sections
const sections = computed<FieldSection[]>(() => {
@@ -147,11 +137,12 @@ const validateForm = (): boolean => {
const handleSave = () => {
if (validateForm()) {
// Preserve id and other system fields from original data when saving
emit('save', {
id: props.data?.id, // Preserve the record ID for updates
...formData.value
})
// Start with props.data to preserve system fields like id, then override with user edits
const dataToSave = {
...props.data,
...formData.value,
}
emit('save', dataToSave)
}
}

30
frontend/components/views/EditViewEnhanced.vue
View File

@@ -45,16 +45,11 @@ const errors = ref<Record<string, string>>({})
// Watch for data changes (useful for edit mode)
watch(() => props.data, (newData) => {
console.log('[EditViewEnhanced] Data changed:', newData)
console.log('[EditViewEnhanced] Data has id?', newData?.id)
formData.value = { ...newData }
}, { deep: true, immediate: true })
}, { deep: true })
// Fetch page layout if objectId is provided
onMounted(async () => {
console.log('[EditViewEnhanced] Component mounted')
console.log('[EditViewEnhanced] Props:', props)
if (props.objectId) {
try {
loadingLayout.value = true
@@ -164,27 +159,12 @@ const validateForm = (): boolean => {
}
const handleSave = () => {
console.log('[EditViewEnhanced] handleSave called')
console.log('[EditViewEnhanced] props.data:', props.data)
console.log('[EditViewEnhanced] props.data?.id:', props.data?.id)
console.log('[EditViewEnhanced] formData before processing:', { ...formData.value })
if (validateForm()) {
// Preserve the id from props.data if it exists (needed for updates)
// Filter out other system fields that are auto-managed
const saveData = { ...formData.value }
const systemFieldsToRemove = ['tenantId', 'ownerId', 'created_at', 'updated_at', 'createdAt', 'updatedAt', 'createdBy', 'updatedBy']
for (const field of systemFieldsToRemove) {
delete saveData[field]
// Start with props.data to preserve system fields like id, then override with user edits
const saveData = {
...props.data,
...formData.value,
}
// Explicitly preserve id if it exists in the original data
if (props.data?.id) {
saveData.id = props.data.id
console.log('[EditViewEnhanced] Preserved id from props:', saveData.id)
}
console.log('[EditViewEnhanced] Final saveData:', saveData)
emit('save', saveData)
}
}

4
frontend/components/views/ListView.vue
View File

@@ -22,7 +22,6 @@ interface Props {
loading?: boolean
selectable?: boolean
baseUrl?: string
canCreate?: boolean
}
const props = withDefaults(defineProps<Props>(), {
@@ -30,7 +29,6 @@ const props = withDefaults(defineProps<Props>(), {
loading: false,
selectable: false,
baseUrl: '/runtime/objects',
canCreate: true,
})
const emit = defineEmits<{
@@ -147,7 +145,7 @@ const handleAction = (actionId: string) => {
</Button>
<!-- Create -->
<Button v-if="props.canCreate" size="sm" @click="emit('create')">
<Button size="sm" @click="emit('create')">
<Plus class="h-4 w-4 mr-2" />
New
</Button>

23
frontend/composables/useApi.ts
View File

@@ -45,9 +45,7 @@ export const useApi = () => {
toast.error('Your session has expired. Please login again.')
router.push('/login')
}
const error = new Error('Unauthorized')
;(error as any).status = 401
throw error
throw new Error('Unauthorized')
}
if (response.status === 403) {
@@ -61,24 +59,17 @@ export const useApi = () => {
router.push('/login')
}
}
// Don't log 403 errors - create error with status flag
const error = new Error('Forbidden')
;(error as any).status = 403
throw error
throw new Error('Forbidden')
}
if (!response.ok) {
// Try to get error details from response
const text = await response.text()
// Only log unexpected errors (not 401 or 403 which are handled above)
if (response.status !== 401 && response.status !== 403) {
console.error('API Error Response:', {
status: response.status,
statusText: response.statusText,
body: text
})
}
console.error('API Error Response:', {
status: response.status,
statusText: response.statusText,
body: text
})
let errorMessage = `HTTP error! status: ${response.status}`
if (text) {

34
frontend/composables/useFieldViews.ts
View File

@@ -197,10 +197,7 @@ export const useViewState = <T extends { id?: string }>(
records.value = response.data || response || []
} catch (e: any) {
error.value = e.message
// Only log unexpected errors (not authorization failures)
if (e.status !== 401 && e.status !== 403) {
console.error('Failed to fetch records:', e)
}
console.error('Failed to fetch records:', e)
} finally {
loading.value = false
}
@@ -215,10 +212,7 @@ export const useViewState = <T extends { id?: string }>(
currentRecord.value = response.data || response
} catch (e: any) {
error.value = e.message
// Only log unexpected errors (not authorization failures)
if (e.status !== 401 && e.status !== 403) {
console.error('Failed to fetch record:', e)
}
console.error('Failed to fetch record:', e)
} finally {
loading.value = false
}
@@ -237,7 +231,7 @@ export const useViewState = <T extends { id?: string }>(
return recordData
} catch (e: any) {
error.value = e.message
// Don't log to console - errors are already handled by useApi and shown via toast
console.error('Failed to create record:', e)
throw e
} finally {
saving.value = false
@@ -262,10 +256,7 @@ export const useViewState = <T extends { id?: string }>(
return recordData
} catch (e: any) {
error.value = e.message
// Only log unexpected errors (not authorization failures)
if (e.status !== 401 && e.status !== 403) {
console.error('Failed to update record:', e)
}
console.error('Failed to update record:', e)
throw e
} finally {
saving.value = false
@@ -283,10 +274,7 @@ export const useViewState = <T extends { id?: string }>(
}
} catch (e: any) {
error.value = e.message
// Only log unexpected errors (not authorization failures)
if (e.status !== 401 && e.status !== 403) {
console.error('Failed to delete record:', e)
}
console.error('Failed to delete record:', e)
throw e
} finally {
loading.value = false
@@ -301,10 +289,7 @@ export const useViewState = <T extends { id?: string }>(
records.value = records.value.filter(r => !ids.includes(r.id!))
} catch (e: any) {
error.value = e.message
// Only log unexpected errors (not authorization failures)
if (e.status !== 401 && e.status !== 403) {
console.error('Failed to delete records:', e)
}
console.error('Failed to delete records:', e)
throw e
} finally {
loading.value = false
@@ -327,17 +312,10 @@ export const useViewState = <T extends { id?: string }>(
}
const handleSave = async (data: T) => {
// DEBUG: Check if id is present
console.log('[handleSave] Data received:', JSON.stringify(data, null, 2))
console.log('[handleSave] data.id:', data.id)
console.log('[handleSave] currentRecord.value:', currentRecord.value)
let savedRecord
if (data.id) {
console.log('[handleSave] Calling updateRecord (PUT)')
savedRecord = await updateRecord(data.id, data)
} else {
console.log('[handleSave] Calling createRecord (POST) - ID IS MISSING!')
savedRecord = await createRecord(data)
}
return savedRecord

132
frontend/pages/[objectName]/[[recordId]]/[[view]].vue
View File

@@ -3,18 +3,14 @@ import { ref, computed, onMounted, watch, nextTick } from 'vue'
import { useRoute, useRouter } from 'vue-router'
import { useApi } from '@/composables/useApi'
import { useFields, useViewState } from '@/composables/useFieldViews'
import { useAuth } from '@/composables/useAuth'
import ListView from '@/components/views/ListView.vue'
import DetailView from '@/components/views/DetailViewEnhanced.vue'
import EditView from '@/components/views/EditViewEnhanced.vue'
import RecordShareManager from '@/components/RecordShareManager.vue'
import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs'
const route = useRoute()
const router = useRouter()
const { api } = useApi()
const { buildListViewConfig, buildDetailViewConfig, buildEditViewConfig } = useFields()
const { getUser } = useAuth()
// Use breadcrumbs composable
const { setBreadcrumbs } = useBreadcrumbs()
@@ -36,7 +32,6 @@ const view = computed(() => {
// State
const objectDefinition = ref<any>(null)
const objectAccess = ref<any>(null)
const loading = ref(true)
const error = ref<string | null>(null)
@@ -123,50 +118,9 @@ const detailConfig = computed(() => {
const editConfig = computed(() => {
if (!objectDefinition.value) return null
const config = buildEditViewConfig(objectDefinition.value)
return config
return buildEditViewConfig(objectDefinition.value)
})
// Compute canCreate based on objectAccess
// Note: MySQL BOOLEAN fields return 0/1 (numbers), not true/false
const canCreate = computed(() => {
const publicCreate = objectAccess.value?.publicCreate
const result = publicCreate === true || publicCreate === 1
return result
})
// Check if user can share the record
const canShareRecord = computed(() => {
if (!currentRecord.value) return false
const user = getUser()
if (!user) return false
// User can share if they own the record
return currentRecord.value.ownerId === user.id
})
// Get current user's permissions for the record
const currentUserPermissions = computed(() => {
if (!objectDefinition.value || !currentRecord.value) {
return { canRead: false, canUpdate: false, canDelete: false }
}
const user = getUser()
const isOwner = user ? currentRecord.value.ownerId === user.id : false
const accessModel = objectDefinition.value.access_model || objectDefinition.value.accessModel
const publicRead = objectAccess.value?.publicRead === true || objectAccess.value?.publicRead === 1
const publicUpdate = objectAccess.value?.publicUpdate === true || objectAccess.value?.publicUpdate === 1
const publicDelete = objectAccess.value?.publicDelete === true || objectAccess.value?.publicDelete === 1
return {
canRead: isOwner || publicRead || accessModel === 'public',
canUpdate: isOwner || publicUpdate,
canDelete: isOwner || publicDelete
}
})
// Active tab for detail view with sharing
const activeTab = ref('details')
// Fetch object definition
const fetchObjectDefinition = async () => {
try {
@@ -174,20 +128,6 @@ const fetchObjectDefinition = async () => {
error.value = null
const response = await api.get(`/setup/objects/${objectApiName.value}`)
objectDefinition.value = response
// Fetch access permissions
try {
const accessResponse = await api.get(`/setup/objects/${objectApiName.value}/access`)
objectAccess.value = accessResponse
} catch (e) {
// Set defaults if fetch fails - assume most restrictive
objectAccess.value = {
publicCreate: false,
publicRead: false,
publicUpdate: false,
publicDelete: false,
}
}
} catch (e: any) {
error.value = e.message || 'Failed to load object definition'
console.error('Error fetching object definition:', e)
@@ -321,7 +261,6 @@ onMounted(async () => {
:data="records"
:loading="dataLoading"
:base-url="`/runtime/objects`"
:can-create="canCreate"
selectable
@row-click="handleRowClick"
@create="handleCreate"
@@ -329,53 +268,32 @@ onMounted(async () => {
@delete="handleDelete"
/>
<!-- Detail View with Tabs -->
<div v-else-if="view === 'detail' && detailConfig && currentRecord">
<Tabs v-model="activeTab" class="w-full">
<TabsList class="grid w-full mb-6" :class="canShareRecord ? 'grid-cols-2' : 'grid-cols-1'">
<TabsTrigger value="details">Details</TabsTrigger>
<TabsTrigger v-if="canShareRecord" value="sharing">Sharing</TabsTrigger>
</TabsList>
<TabsContent value="details">
<DetailView
:config="detailConfig"
:data="currentRecord"
:loading="dataLoading"
:object-id="objectDefinition?.id"
:base-url="`/runtime/objects`"
@edit="handleEdit"
@delete="() => handleDelete([currentRecord])"
@back="handleBack"
/>
</TabsContent>
<TabsContent v-if="canShareRecord" value="sharing">
<RecordShareManager
:object-api-name="objectApiName"
:record-id="recordId!"
:current-user-permissions="currentUserPermissions"
:fields="objectDefinition?.fields || []"
/>
</TabsContent>
</Tabs>
</div>
<!-- Detail View -->
<DetailView
v-else-if="view === 'detail' && detailConfig && currentRecord"
:config="detailConfig"
:data="currentRecord"
:loading="dataLoading"
:object-id="objectDefinition?.id"
:base-url="`/runtime/objects`"
@edit="handleEdit"
@delete="() => handleDelete([currentRecord])"
@back="handleBack"
/>
<!-- Edit View -->
<div v-else-if="(view === 'edit' || recordId === 'new') && editConfig">
<div v-if="false">DEBUG: EditView should render here. view={{ view }}, recordId={{ recordId }}, editConfig={{ !!editConfig }}, currentRecord={{ !!currentRecord }}</div>
<EditView
:config="editConfig"
:data="currentRecord || {}"
:loading="dataLoading"
:saving="saving"
:object-id="objectDefinition?.id"
:base-url="`/runtime/objects`"
@save="handleSaveRecord"
@cancel="handleCancel"
@back="handleBack"
/>
</div>
<EditView
v-else-if="(view === 'edit' || recordId === 'new') && editConfig"
:config="editConfig"
:data="currentRecord || {}"
:loading="dataLoading"
:saving="saving"
:object-id="objectDefinition?.id"
:base-url="`/runtime/objects`"
@save="handleSaveRecord"
@cancel="handleCancel"
@back="handleBack"
/>
</div>
</NuxtLayout>
</template>

28
frontend/pages/setup/objects/[apiName].vue
View File

@@ -18,8 +18,8 @@
<Tabs v-model="activeTab" default-value="fields" class="w-full">
<TabsList class="grid w-full grid-cols-3 max-w-2xl">
<TabsTrigger value="fields">Fields</TabsTrigger>
<TabsTrigger value="access">Access</TabsTrigger>
<TabsTrigger value="layouts">Page Layouts</TabsTrigger>
<TabsTrigger value="access">Access & Permissions</TabsTrigger>
</TabsList>
<!-- Fields Tab -->
@@ -56,6 +56,17 @@
</div>
</TabsContent>
<!-- Access Tab -->
<TabsContent value="access" class="mt-6">
<ObjectAccessSettings
:object-api-name="object.apiName"
:object-id="object.id"
:org-wide-default="object.orgWideDefault"
:fields="object.fields"
@update="handleAccessUpdate"
/>
</TabsContent>
<!-- Page Layouts Tab -->
<TabsContent value="layouts" class="mt-6">
<div v-if="!selectedLayout" class="space-y-4">
@@ -126,15 +137,6 @@
/>
</div>
</TabsContent>
<!-- Access & Permissions Tab -->
<TabsContent value="access" class="mt-6">
<ObjectAccessSettings
:object-api-name="object.apiName"
:fields="object.fields"
@updated="fetchObject"
/>
</TabsContent>
</Tabs>
</div>
</div>
@@ -258,7 +260,11 @@ watch(activeTab, (newTab) => {
fetchLayouts()
}
})
const handleAccessUpdate = (orgWideDefault: string) => {
if (object.value) {
object.value.orgWideDefault = orgWideDefault
}
}
onMounted(async () => {
await fetchObject()
// If we start on layouts tab, load them

185
frontend/pages/setup/roles.vue
View File

@@ -1,185 +0,0 @@
<template>
<div class="min-h-screen bg-background">
<NuxtLayout name="default">
<main class="container mx-auto px-4 py-8">
<div class="mb-6 flex items-center justify-between">
<div>
<h1 class="text-3xl font-bold">Roles & Permissions</h1>
<p class="text-muted-foreground">Manage user roles and their permissions across objects</p>
</div>
<Button @click="showCreateDialog = true">
<Plus class="w-4 h-4 mr-2" />
New Role
</Button>
</div>
<div v-if="loading" class="text-center py-12">Loading roles...</div>
<div v-else class="space-y-4">
<Card
v-for="role in roles"
:key="role.id"
class="cursor-pointer hover:border-primary transition-colors"
@click="handleSelectRole(role)"
>
<CardHeader>
<div class="flex items-center justify-between">
<div>
<CardTitle>{{ role.name }}</CardTitle>
<CardDescription v-if="role.description">
{{ role.description }}
</CardDescription>
</div>
<Button
variant="ghost"
size="sm"
@click.stop="handleDeleteRole(role.id)"
>
<Trash2 class="w-4 h-4" />
</Button>
</div>
</CardHeader>
</Card>
<div v-if="roles.length === 0" class="text-center py-12 text-muted-foreground">
No roles yet. Create one to get started.
</div>
</div>
<!-- Create Role Dialog -->
<Dialog v-model:open="showCreateDialog">
<DialogContent>
<DialogHeader>
<DialogTitle>Create New Role</DialogTitle>
<DialogDescription>
Define a new role for your organization
</DialogDescription>
</DialogHeader>
<div class="space-y-4 py-4">
<div class="space-y-2">
<Label>Role Name</Label>
<Input v-model="newRole.name" placeholder="e.g., Account Manager" />
</div>
<div class="space-y-2">
<Label>Description</Label>
<Input v-model="newRole.description" placeholder="Optional description" />
</div>
</div>
<DialogFooter>
<Button variant="outline" @click="showCreateDialog = false">Cancel</Button>
<Button @click="handleCreateRole" :disabled="!newRole.name || creating">
{{ creating ? 'Creating...' : 'Create' }}
</Button>
</DialogFooter>
</DialogContent>
</Dialog>
<!-- Role Permissions Editor Dialog -->
<Dialog v-model:open="showPermissionsDialog">
<DialogContent class="max-w-4xl max-h-[80vh] overflow-y-auto">
<DialogHeader>
<DialogTitle>Manage Permissions: {{ selectedRole?.name }}</DialogTitle>
<DialogDescription>
Configure what this role can do with each object
</DialogDescription>
</DialogHeader>
<RolePermissionsEditor
v-if="selectedRole"
:role="selectedRole"
@saved="handlePermissionsSaved"
/>
</DialogContent>
</Dialog>
</main>
</NuxtLayout>
</div>
</template>
<script setup lang="ts">
import { Plus, Trash2 } from 'lucide-vue-next'
import { Button } from '@/components/ui/button'
import { Card, CardHeader, CardTitle, CardDescription } from '@/components/ui/card'
import {
Dialog,
DialogContent,
DialogDescription,
DialogFooter,
DialogHeader,
DialogTitle,
} from '@/components/ui/dialog'
import { Input } from '@/components/ui/input'
import { Label } from '@/components/ui/label'
import RolePermissionsEditor from '@/components/RolePermissionsEditor.vue'
const { api } = useApi()
const { toast } = useToast()
const roles = ref<any[]>([])
const loading = ref(true)
const creating = ref(false)
const showCreateDialog = ref(false)
const showPermissionsDialog = ref(false)
const selectedRole = ref<any>(null)
const newRole = ref({
name: '',
description: '',
})
const fetchRoles = async () => {
try {
loading.value = true
roles.value = await api.get('/roles')
} catch (e: any) {
console.error('Error fetching roles:', e)
toast.error('Failed to load roles')
} finally {
loading.value = false
}
}
const handleCreateRole = async () => {
try {
creating.value = true
const created = await api.post('/roles', newRole.value)
roles.value.push(created)
toast.success('Role created successfully')
showCreateDialog.value = false
newRole.value = { name: '', description: '' }
} catch (e: any) {
console.error('Error creating role:', e)
toast.error('Failed to create role')
} finally {
creating.value = false
}
}
const handleSelectRole = (role: any) => {
selectedRole.value = role
showPermissionsDialog.value = true
}
const handleDeleteRole = async (roleId: string) => {
if (!confirm('Are you sure you want to delete this role?')) return
try {
await api.delete(`/roles/${roleId}`)
roles.value = roles.value.filter(r => r.id !== roleId)
toast.success('Role deleted successfully')
} catch (e: any) {
console.error('Error deleting role:', e)
toast.error('Failed to delete role')
}
}
const handlePermissionsSaved = () => {
showPermissionsDialog.value = false
toast.success('Permissions saved successfully')
}
onMounted(() => {
fetchRoles()
})
</script>