mirror of https://github.com/Squidex/squidex.git
Sebastian
7 years ago
40 changed files with 369 additions and 610 deletions
@ -0,0 +1,39 @@ |
|||||
|
// ==========================================================================
|
||||
|
// Squidex Headless CMS
|
||||
|
// ==========================================================================
|
||||
|
// Copyright (c) Squidex UG (haftungsbeschraenkt)
|
||||
|
// All rights reserved. Licensed under the MIT license.
|
||||
|
// ==========================================================================
|
||||
|
|
||||
|
using Squidex.Areas.Api.Controllers.Backups; |
||||
|
using Squidex.Areas.Api.Controllers.EventConsumers; |
||||
|
using Squidex.Shared; |
||||
|
using Squidex.Web; |
||||
|
|
||||
|
namespace Squidex.Areas.Api.Controllers.Users.Models |
||||
|
{ |
||||
|
public sealed class ResourcesDto : Resource |
||||
|
{ |
||||
|
public static ResourcesDto FromController(ApiController controller) |
||||
|
{ |
||||
|
var result = new ResourcesDto(); |
||||
|
|
||||
|
if (controller.HasPermission(Permissions.AdminEventsRead)) |
||||
|
{ |
||||
|
result.AddGetLink("admin/eventConsumers", controller.Url<EventConsumersController>(x => nameof(x.GetEventConsumers))); |
||||
|
} |
||||
|
|
||||
|
if (controller.HasPermission(Permissions.AdminRestoreRead)) |
||||
|
{ |
||||
|
result.AddGetLink("admin/restore", controller.Url<RestoreController>(x => nameof(x.GetJob))); |
||||
|
} |
||||
|
|
||||
|
if (controller.HasPermission(Permissions.AdminUsersRead)) |
||||
|
{ |
||||
|
result.AddGetLink("admin/users", controller.Url<UserManagementController>(x => nameof(x.GetUsers))); |
||||
|
} |
||||
|
|
||||
|
return result; |
||||
|
} |
||||
|
} |
||||
|
} |
||||
@ -1,145 +0,0 @@ |
|||||
/* |
|
||||
* Squidex Headless CMS |
|
||||
* |
|
||||
* @license |
|
||||
* Copyright (c) Squidex UG (haftungsbeschränkt). All rights reserved. |
|
||||
*/ |
|
||||
|
|
||||
import { Permission } from './permission'; |
|
||||
|
|
||||
describe('Permission', () => { |
|
||||
it('should check when permissions are not equal', () => { |
|
||||
const g = new Permission('app.contents'); |
|
||||
const r = new Permission('app.assets'); |
|
||||
|
|
||||
expect(g.allows(r)).toBeFalsy(); |
|
||||
|
|
||||
expect(g.includes(r)).toBeFalsy(); |
|
||||
}); |
|
||||
|
|
||||
it('should check when permissions are equal with wildcards', () => { |
|
||||
const g = new Permission('app.*'); |
|
||||
const r = new Permission('app.*'); |
|
||||
|
|
||||
expect(g.allows(r)).toBeTruthy(); |
|
||||
|
|
||||
expect(g.includes(r)).toBeTruthy(); |
|
||||
}); |
|
||||
|
|
||||
it('should check when equal permissions', () => { |
|
||||
const g = new Permission('app.contents'); |
|
||||
const r = new Permission('app.contents'); |
|
||||
|
|
||||
expect(g.allows(r)).toBeTruthy(); |
|
||||
|
|
||||
expect(g.includes(r)).toBeTruthy(); |
|
||||
}); |
|
||||
|
|
||||
it('should check when given is parent of requested', () => { |
|
||||
const g = new Permission('app'); |
|
||||
const r = new Permission('app.contents'); |
|
||||
|
|
||||
expect(g.allows(r)).toBeTruthy(); |
|
||||
|
|
||||
expect(g.includes(r)).toBeTruthy(); |
|
||||
}); |
|
||||
|
|
||||
it('should check when requested is parent of given', () => { |
|
||||
const g = new Permission('app.contents'); |
|
||||
const r = new Permission('app'); |
|
||||
|
|
||||
expect(g.allows(r)).toBeFalsy(); |
|
||||
|
|
||||
expect(g.includes(r)).toBeTruthy(); |
|
||||
}); |
|
||||
|
|
||||
it('should check when given is wildcard of requested', () => { |
|
||||
const g = new Permission('app.*'); |
|
||||
const r = new Permission('app.contents'); |
|
||||
|
|
||||
expect(g.allows(r)).toBeTruthy(); |
|
||||
|
|
||||
expect(g.includes(r)).toBeTruthy(); |
|
||||
}); |
|
||||
|
|
||||
it('should check when requested is wildcard of given', () => { |
|
||||
const g = new Permission('app.contents'); |
|
||||
const r = new Permission('app.*'); |
|
||||
|
|
||||
expect(g.allows(r)).toBeFalsy(); |
|
||||
|
|
||||
expect(g.includes(r)).toBeTruthy(); |
|
||||
}); |
|
||||
|
|
||||
it('should check when given is has alternatives of requested', () => { |
|
||||
const g = new Permission('app.contents|schemas'); |
|
||||
const r = new Permission('app.contents'); |
|
||||
|
|
||||
expect(g.allows(r)).toBeTruthy(); |
|
||||
|
|
||||
expect(g.includes(r)).toBeTruthy(); |
|
||||
}); |
|
||||
|
|
||||
it('should check when requested is has alternatives of given', () => { |
|
||||
const g = new Permission('app.contents'); |
|
||||
const r = new Permission('app.contents|schemas'); |
|
||||
|
|
||||
expect(g.allows(r)).toBeTruthy(); |
|
||||
|
|
||||
expect(g.includes(r)).toBeTruthy(); |
|
||||
}); |
|
||||
|
|
||||
|
|
||||
it('should check for requested is null', () => { |
|
||||
const g = new Permission('app.contents'); |
|
||||
|
|
||||
expect(g.allows(null!)).toBeFalsy(); |
|
||||
|
|
||||
expect(g.includes(null!)).toBeFalsy(); |
|
||||
}); |
|
||||
|
|
||||
it('should return true if any permission gives permission to requested', () => { |
|
||||
const set = [ |
|
||||
new Permission('app.contents'), |
|
||||
new Permission('app.assets') |
|
||||
]; |
|
||||
|
|
||||
expect(new Permission('app.contents').allowedBy(set)).toBeTruthy(); |
|
||||
}); |
|
||||
|
|
||||
it('should return true if any permission includes parent given', () => { |
|
||||
const set = [ |
|
||||
new Permission('app.contents'), |
|
||||
new Permission('app.assets') |
|
||||
]; |
|
||||
|
|
||||
expect(new Permission('app').includedIn(set)).toBeTruthy(); |
|
||||
}); |
|
||||
|
|
||||
it('should return true if any permission includes child given', () => { |
|
||||
const set = [ |
|
||||
new Permission('app.contents'), |
|
||||
new Permission('app.assets') |
|
||||
]; |
|
||||
|
|
||||
expect(new Permission('app.contents.read').includedIn(set)).toBeTruthy(); |
|
||||
}); |
|
||||
|
|
||||
it('should return false if none permission gives permission to requested', () => { |
|
||||
const set = [ |
|
||||
new Permission('app.contents'), |
|
||||
new Permission('app.assets') |
|
||||
]; |
|
||||
|
|
||||
expect(new Permission('app.schemas').allowedBy(set)).toBeFalsy(); |
|
||||
}); |
|
||||
|
|
||||
it('should return false if none permission includes given', () => { |
|
||||
const set = [ |
|
||||
new Permission('app.contents'), |
|
||||
new Permission('app.assets') |
|
||||
]; |
|
||||
|
|
||||
expect(new Permission('other').allowedBy(set)).toBeFalsy(); |
|
||||
}); |
|
||||
}); |
|
||||
@ -1,116 +0,0 @@ |
|||||
/* |
|
||||
* Squidex Headless CMS |
|
||||
* |
|
||||
* @license |
|
||||
* Copyright (c) Squidex UG (haftungsbeschränkt). All rights reserved. |
|
||||
*/ |
|
||||
|
|
||||
import { Types } from './types'; |
|
||||
|
|
||||
export class Permission { |
|
||||
private readonly parts: ({ [key: string]: true } | null)[]; |
|
||||
|
|
||||
constructor( |
|
||||
public readonly id: string |
|
||||
) { |
|
||||
this.parts = id.split('.').map(x => { |
|
||||
if (x === '*') { |
|
||||
return null; |
|
||||
} else { |
|
||||
const result: { [key: string]: true } = {}; |
|
||||
|
|
||||
for (let p of x.split('|')) { |
|
||||
result[p] = true; |
|
||||
} |
|
||||
|
|
||||
return result; |
|
||||
} |
|
||||
}); |
|
||||
} |
|
||||
|
|
||||
public includedIn(permissions: Permission[]) { |
|
||||
for (let permission of permissions) { |
|
||||
if (permission.includes(this)) { |
|
||||
return true; |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
return false; |
|
||||
} |
|
||||
|
|
||||
public allowedBy(permissions: Permission[]) { |
|
||||
for (let permission of permissions) { |
|
||||
if (permission.allows(this)) { |
|
||||
return true; |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
return false; |
|
||||
} |
|
||||
|
|
||||
public includes(permission?: Permission | string) { |
|
||||
if (!permission) { |
|
||||
return false; |
|
||||
} |
|
||||
|
|
||||
if (Types.isString(permission)) { |
|
||||
permission = new Permission(permission); |
|
||||
} |
|
||||
|
|
||||
for (let i = 0; i < Math.min(permission.parts.length, this.parts.length); i++) { |
|
||||
const lhs = this.parts[i]; |
|
||||
const rhs = permission.parts[i]; |
|
||||
|
|
||||
if (lhs != null && rhs != null && !Permission.intersects(lhs, rhs)) { |
|
||||
return false; |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
return true; |
|
||||
} |
|
||||
|
|
||||
public allows(permission?: Permission | string) { |
|
||||
if (!permission) { |
|
||||
return false; |
|
||||
} |
|
||||
|
|
||||
if (Types.isString(permission)) { |
|
||||
permission = new Permission(permission); |
|
||||
} |
|
||||
|
|
||||
if (this.parts.length > permission.parts.length) { |
|
||||
return false; |
|
||||
} |
|
||||
|
|
||||
for (let i = 0; i < this.parts.length; i++) { |
|
||||
const lhs = this.parts[i]; |
|
||||
const rhs = permission.parts[i]; |
|
||||
|
|
||||
if (lhs !== null && (rhs === null || !Permission.intersects(lhs, rhs))) { |
|
||||
return false; |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
return true; |
|
||||
} |
|
||||
|
|
||||
private static intersects(lhs: { [key: string]: true }, rhs: { [key: string]: true }) { |
|
||||
for (let key in lhs) { |
|
||||
if (lhs.hasOwnProperty(key)) { |
|
||||
if (rhs[key]) { |
|
||||
return true; |
|
||||
} |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
for (let key in rhs) { |
|
||||
if (rhs.hasOwnProperty(key)) { |
|
||||
if (lhs[key]) { |
|
||||
return true; |
|
||||
} |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
return false; |
|
||||
} |
|
||||
} |
|
||||
@ -1,133 +0,0 @@ |
|||||
/* |
|
||||
* Squidex Headless CMS |
|
||||
* |
|
||||
* @license |
|
||||
* Copyright (c) Squidex UG (haftungsbeschränkt). All rights reserved. |
|
||||
*/ |
|
||||
|
|
||||
import { ChangeDetectorRef, Directive, Input, OnChanges, OnInit, TemplateRef, ViewContainerRef } from '@angular/core'; |
|
||||
|
|
||||
import { |
|
||||
AppDto, |
|
||||
AppsState, |
|
||||
AuthService, |
|
||||
Permission, |
|
||||
ResourceOwner, |
|
||||
SchemaDto, |
|
||||
SchemasState |
|
||||
} from '@app/shared/internal'; |
|
||||
|
|
||||
@Directive({ |
|
||||
selector: '[sqxPermission]' |
|
||||
}) |
|
||||
export class PermissionDirective extends ResourceOwner implements OnChanges, OnInit { |
|
||||
private viewCreated = false; |
|
||||
|
|
||||
@Input('sqxPermissionApp') |
|
||||
public app?: AppDto; |
|
||||
|
|
||||
@Input('sqxPermissionSchema') |
|
||||
public schema?: SchemaDto; |
|
||||
|
|
||||
@Input('sqxPermission') |
|
||||
public permissions: string; |
|
||||
|
|
||||
constructor( |
|
||||
private readonly authService: AuthService, |
|
||||
private readonly appsState: AppsState, |
|
||||
private readonly changeDetector: ChangeDetectorRef, |
|
||||
private readonly schemasState: SchemasState, |
|
||||
private readonly templateRef: TemplateRef<any>, |
|
||||
private readonly viewContainer: ViewContainerRef |
|
||||
) { |
|
||||
super(); |
|
||||
} |
|
||||
|
|
||||
public ngOnInit() { |
|
||||
this.own( |
|
||||
this.appsState.selectedApp.subscribe(app => { |
|
||||
if (app && !this.app) { |
|
||||
this.update(app, this.schemasState.snapshot.selectedSchema); |
|
||||
} |
|
||||
})); |
|
||||
|
|
||||
this.own( |
|
||||
this.schemasState.selectedSchema.subscribe(schema => { |
|
||||
if (schema && !this.schema) { |
|
||||
this.update(this.appsState.snapshot.selectedApp, schema); |
|
||||
} |
|
||||
})); |
|
||||
} |
|
||||
|
|
||||
public ngOnChanges() { |
|
||||
this.update(this.appsState.snapshot.selectedApp, this.schemasState.snapshot.selectedSchema); |
|
||||
} |
|
||||
|
|
||||
private update(app?: AppDto | null, schema?: SchemaDto | null) { |
|
||||
if (this.app) { |
|
||||
app = this.app; |
|
||||
} |
|
||||
|
|
||||
if (this.schema) { |
|
||||
schema = this.schema; |
|
||||
} |
|
||||
|
|
||||
let permissions = this.permissions; |
|
||||
|
|
||||
let show = false; |
|
||||
|
|
||||
if (permissions) { |
|
||||
let include = permissions[0] === '?'; |
|
||||
|
|
||||
if (include) { |
|
||||
permissions = permissions.substr(1); |
|
||||
} |
|
||||
|
|
||||
const array = permissions.split(';'); |
|
||||
|
|
||||
for (let id of array) { |
|
||||
if (app) { |
|
||||
id = id.replace('{app}', app.name); |
|
||||
} |
|
||||
|
|
||||
if (schema) { |
|
||||
id = id.replace('{name}', schema.name); |
|
||||
} |
|
||||
|
|
||||
const permission = new Permission(id); |
|
||||
|
|
||||
if (include) { |
|
||||
if (app && permission.includedIn(app.permissions)) { |
|
||||
show = true; |
|
||||
} |
|
||||
|
|
||||
if (!show) { |
|
||||
show = permission.includedIn(this.authService.user!.permissions); |
|
||||
} |
|
||||
} else { |
|
||||
if (app && permission.allowedBy(app.permissions)) { |
|
||||
show = true; |
|
||||
} |
|
||||
|
|
||||
if (!show) { |
|
||||
show = permission.allowedBy(this.authService.user!.permissions); |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
if (show) { |
|
||||
break; |
|
||||
} |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
if (show && !this.viewCreated) { |
|
||||
this.viewContainer.createEmbeddedView(this.templateRef); |
|
||||
this.viewCreated = true; |
|
||||
} else if (!show && this.viewCreated) { |
|
||||
this.viewContainer.clear(); |
|
||||
this.viewCreated = false; |
|
||||
} |
|
||||
|
|
||||
this.changeDetector.markForCheck(); |
|
||||
} |
|
||||
} |
|
||||
Loading…
Reference in new issue