@sms/plugin-rbac

Interfaces

Access

Defined in: packages/plugins/rbac/src/contract.ts:28

Properties

create?

optional create?: boolean;

Defined in: packages/plugins/rbac/src/contract.ts:33

group

group: string;

Defined in: packages/plugins/rbac/src/contract.ts:30

model

model: string;

Defined in: packages/plugins/rbac/src/contract.ts:29

read?

optional read?: boolean;

Defined in: packages/plugins/rbac/src/contract.ts:31

unlink?

optional unlink?: boolean;

Defined in: packages/plugins/rbac/src/contract.ts:34

write?

optional write?: boolean;

Defined in: packages/plugins/rbac/src/contract.ts:32

Group

Defined in: packages/plugins/rbac/src/contract.ts:21

Properties

description?

optional description?: string;

Defined in: packages/plugins/rbac/src/contract.ts:23

implies?

optional implies?: string[];

Defined in: packages/plugins/rbac/src/contract.ts:25

Members of this group are also members of these (transitively).

name

name: string;

Defined in: packages/plugins/rbac/src/contract.ts:22

RbacAdminService

Defined in: packages/plugins/rbac/src/contract.ts:66

Methods

directGroupsOf()

directGroupsOf(userId): Promise<string[]>;

Defined in: packages/plugins/rbac/src/contract.ts:70

Direct (unexpanded) groups of a user.

Parameters

Returns

Promise<string[]>

grant()

grant(userId, group): Promise<void>;

Defined in: packages/plugins/rbac/src/contract.ts:67

Parameters

Returns

Promise<void>

members()

members(group): Promise<number[]>;

Defined in: packages/plugins/rbac/src/contract.ts:71

Parameters

Returns

Promise<number[]>

revoke()

revoke(userId, group): Promise<void>;

Defined in: packages/plugins/rbac/src/contract.ts:68

Parameters

Returns

Promise<void>

RbacService

Defined in: packages/plugins/rbac/src/contract.ts:55

Methods

assertCan()

assertCan(q): Promise<void>;

Defined in: packages/plugins/rbac/src/contract.ts:62

Throws HttpError(403, …, 'forbidden') when can is false.

Parameters

Returns

Promise<void>

can()

can(q): Promise<boolean>;

Defined in: packages/plugins/rbac/src/contract.ts:58

Parameters

Returns

Promise<boolean>

groups()

groups(): Group & {
  owner: string;
}[];

Defined in: packages/plugins/rbac/src/contract.ts:63

Returns

Group & { owner: string; }[]

groupsOf()

groupsOf(userId): Promise<string[]>;

Defined in: packages/plugins/rbac/src/contract.ts:57

Group names of a user, expanded through implies.

Parameters

Returns

Promise<string[]>

ruleDomain()

ruleDomain(q): Promise<Domain>;

Defined in: packages/plugins/rbac/src/contract.ts:60

Restriction to AND into a query: global rules AND (OR of the user’s group rules). [] = none.

Parameters

Returns

Promise<Domain>

Rule

Defined in: packages/plugins/rbac/src/contract.ts:37

Properties

domain

domain: Domain;

Defined in: packages/plugins/rbac/src/contract.ts:42

groups?

optional groups?: string[];

Defined in: packages/plugins/rbac/src/contract.ts:41

Applies to members of any of these groups; absent = to everyone (a global rule, AND-ed).

model

model: string;

Defined in: packages/plugins/rbac/src/contract.ts:39

name

name: string;

Defined in: packages/plugins/rbac/src/contract.ts:38

ops?

optional ops?: Op[];

Defined in: packages/plugins/rbac/src/contract.ts:44

Default: all ops.

Subject

Defined in: packages/plugins/rbac/src/contract.ts:47

Properties

isAdmin?

optional isAdmin?: boolean;

Defined in: packages/plugins/rbac/src/contract.ts:50

Admins bypass the matrix and the rules.

userId

userId: number;

Defined in: packages/plugins/rbac/src/contract.ts:48

Type Aliases

Domain

type Domain = (DomainLeaf | "&" | "|" | "!")[];

Defined in: packages/plugins/rbac/src/contract.ts:19

DomainLeaf

type DomainLeaf = [string, "=" | "!=" | "<" | "<=" | ">" | ">=" | "in" | "not in" | "like" | "ilike", unknown];

Defined in: packages/plugins/rbac/src/contract.ts:14

Odoo-style prefix domain (same shape as @sms/plugin-orm’s; duplicated so rbac stays independent).

Op

type Op = "read" | "write" | "create" | "unlink";

Defined in: packages/plugins/rbac/src/contract.ts:10

Query

type Query = Subject & {
  model: string;
  op: Op;
};

Defined in: packages/plugins/rbac/src/contract.ts:53

Type Declaration

model

model: string;

op

op: Op;

Variables

ACCESS_POINT

const ACCESS_POINT: "access" = 'access';

Defined in: packages/plugins/rbac/src/contract.ts:77

GROUP_POINT

const GROUP_POINT: "group" = 'group';

Defined in: packages/plugins/rbac/src/contract.ts:76

OPS

const OPS: Op[];

Defined in: packages/plugins/rbac/src/contract.ts:11

RBAC_ADMIN_KEY

const RBAC_ADMIN_KEY: "rbac-admin" = 'rbac-admin';

Defined in: packages/plugins/rbac/src/contract.ts:75

RBAC_KEY

const RBAC_KEY: "rbac" = 'rbac';

Defined in: packages/plugins/rbac/src/contract.ts:74

rbacPlugin

const rbacPlugin: SystemPlugin;

Defined in: packages/plugins/rbac/src/index.ts:66

RULE_POINT

const RULE_POINT: "rule" = 'rule';

Defined in: packages/plugins/rbac/src/contract.ts:78

Functions

expandGroups()

function expandGroups(names, groups): string[];

Defined in: packages/plugins/rbac/src/contract.ts:125

Expand names through implies, transitively and cycle-safe.

Parameters

Returns

string[]

orDomains()

function orDomains(ds): Domain;

Defined in: packages/plugins/rbac/src/contract.ts:118

OR several domains in prefix notation: ['|', '|', ...a, ...b, ...c]. An empty domain means “no restriction”, so OR-ing one in yields the unrestricted domain []; multi-leaf (implicit-AND) domains are wrapped with & so each stays one operand.

Parameters

Returns

Domain

validateAccess()

function validateAccess(item): void;

Defined in: packages/plugins/rbac/src/contract.ts:88

Parameters

Returns

void

validateGroup()

function validateGroup(item): void;

Defined in: packages/plugins/rbac/src/contract.ts:82

Parameters

Returns

void

validateRule()

function validateRule(item): void;

Defined in: packages/plugins/rbac/src/contract.ts:94

Parameters

Returns

void

References

IDENTITY_KEY

Re-exports IDENTITY_KEY

IdentityService

Re-exports IdentityService