[RFC] Casl ownership specification

.eslintrc.json

@@ -27,6 +27,12 @@
           {
             "ignore": ["^@(trxn)/"]
           }
+        ],
+        "prefer-const": [
+          "error",
+          {
+            "destructuring": "all"
+          }
         ]
       }
     },

examples/api-prisma/prisma/schema.prisma

@@ -28,8 +28,8 @@ generator graphqlResolvers {
   output = "../src/nestjs-resolvers"
 
   // Path relative to the output directory
-  tsConfigFilePath   = "../../tsconfig.app.json"
-  nestjsServicesImportPath = "./nestjs-services"
+  tsConfigFilePath            = "../../tsconfig.app.json"
+  nestjsServicesImportPath    = "./nestjs-services"
   nestjsGraphqlDtosImportPath = "./nestjs-graphql-dtos"
 }
 
@@ -43,24 +43,26 @@ generator nestjsServices {
 //--------------------------------------------
 // This part describe the project models
 //--------------------------------------------
+
 model User {
-  id      Int      @id @default(autoincrement())
-  email   String   @unique
-  name    String?
-  role   Role   @relation(fields: [roleId], references: [id])
-  roleId Int
+  id       Int     @id @default(autoincrement())
+  email    String  @unique
+  password String
+  name     String?
+  role     Role    @relation(fields: [roleId], references: [id])
+  roleId   Int
 }
 
 model Role {
-  id     Int    @id @default(autoincrement())
-  name    String
-  users User[]
+  id     Int     @id @default(autoincrement())
+  name   String
+  users  User[]
   rights Right[]
 }
 
 model Right {
-  id     Int    @id @default(autoincrement())
-  name    String @unique
+  id    Int    @id @default(autoincrement())
+  name  String @unique
   roles Role[]
 }
 

examples/api-prisma/prisma/seed.ts

@@ -0,0 +1,31 @@
+import { PrismaClient } from '@prisma/client';
+import * as bcrypt from 'bcrypt';
+
+const prisma = new PrismaClient();
+
+async function seed() {
+  await prisma.user.upsert({
+    where: { email: '[email protected]' },
+    update: {},
+    create: {
+      email: '[email protected]',
+      name: 'Admin',
+      password: bcrypt.hashSync('password', 10),
+      role: {
+        connectOrCreate: {
+          where: {
+            id: 1,
+          },
+          create: {
+            id: 1,
+            name: 'role 1',
+          },
+        },
+      },
+    },
+  });
+}
+
+seed().catch((e) => {
+  console.error(e);
+});

examples/api-prisma/project.json

@@ -50,12 +50,12 @@
     "serve": {
       "configurations": {
         "production": {
-          "buildTarget": "examples-api-prisma:build-custom:production"
+          "buildTarget": "examples-api-prisma:build:production"
         }
       },
       "executor": "@nrwl/js:node",
       "options": {
-        "buildTarget": "examples-api-prisma:build-custom"
+        "buildTarget": "examples-api-prisma:build"
       }
     },
     "test": {

examples/api-prisma/src/app/modules/authentication.module.ts

@@ -1,17 +1,49 @@
+import { AbilityBuilder } from '@casl/ability';
 import { Module } from '@nestjs/common';
-import { AuthenticationModule as TrxnAuthenticationModule } from '@trxn/nestjs-authentication';
+import { APP_GUARD } from '@nestjs/core';
 
+import {
+  AppAbility,
+  getSelectPrismaUserQuery,
+  UserWithOwnershipIds,
+} from '../../casl';
 import { UserModule } from './user.module';
 
+import {
+  JwtGlobalAuthGuard,
+  AuthenticationModule as TrxnAuthenticationModule,
+} from '@trxn/nestjs-authentication';
+import { Action, CaslModule, PoliciesGuard } from '@trxn/nestjs-casl';
+
 @Module({
   imports: [
+    CaslModule.register({
+      getRoles: () => ['user'],
+      rolePermissions: {
+        user: (
+          ability: AbilityBuilder<AppAbility>,
+          user: UserWithOwnershipIds,
+        ) => {
+          ability.can(Action.Read, 'User', { id: user.id });
+          ability.can(Action.Read, 'Role', { id: user.role.id });
+          ability.can(Action.Read, 'Right', {
+            id: { in: user.role.rights.map(({ id }) => id) },
+          });
+        },
+      },
+    }),
     TrxnAuthenticationModule.register({
       imports: [UserModule],
+      customSelect: getSelectPrismaUserQuery(),
       jwtModuleOptions: {
         secret: 'secret',
       },
     }),
   ],
   exports: [TrxnAuthenticationModule],
+  providers: [
+    { provide: APP_GUARD, useClass: JwtGlobalAuthGuard },
+    { provide: APP_GUARD, useClass: PoliciesGuard },
+  ],
 })
 export class AuthenticationModule {}

examples/api-prisma/src/app/modules/database.module.ts

@@ -1,4 +1,5 @@
 import { Module } from '@nestjs/common';
+
 import { DatabaseModule as TrxnDatabaseModule } from '@trxn/nestjs-database';
 
 @Module({

examples/api-prisma/src/app/modules/graphql.module.ts

@@ -2,23 +2,35 @@ import { ApolloDriver, ApolloDriverConfig } from '@nestjs/apollo';
 import { Module } from '@nestjs/common';
 import { GraphQLModule as NestjsGraphQLModule } from '@nestjs/graphql';
 
-import { GraphqlModule } from '../../nestjs-resolvers';
+import { ModelsAuthorizationServicesModules } from '../../nestjs-authorization-services';
+import { GraphqlAuthorizationModule } from '../../nestjs-graphql-resolvers-casl';
+import { DatabaseModule } from './database.module';
 import { NestjsServicesModule } from './services.module';
 
 @Module({
   imports: [
     NestjsGraphQLModule.forRoot<ApolloDriverConfig>({
       driver: ApolloDriver,
-      include: [GraphqlModule],
+      include: [GraphqlAuthorizationModule],
       autoSchemaFile: 'schema.gql',
       sortSchema: true,
       debug: true,
       playground: true,
     }),
-    GraphqlModule.register({
-      imports: [NestjsServicesModule],
+    GraphqlAuthorizationModule.register({
+      imports: [
+        ModelsAuthorizationServicesModules.register({
+          imports: [DatabaseModule, NestjsServicesModule],
+          defaultOwnershipIndexes: {
+            User: { id: true, roleId: true },
+            Role: { id: true },
+            Right: { id: true },
+          },
+        }),
+        NestjsServicesModule,
+      ],
     }),
   ],
-  exports: [GraphqlModule],
+  exports: [GraphqlAuthorizationModule],
 })
 export class NestjsGraphqlModule {}

examples/api-prisma/src/app/modules/user.module.ts

@@ -1,8 +1,9 @@
 import { Module } from '@nestjs/common';
-import { UserModule as TrxnUserModule } from '@trxn/nestjs-user';
 
 import { NestjsServicesModule } from './services.module';
 
+import { UserModule as TrxnUserModule } from '@trxn/nestjs-user';
+
 @Module({
   imports: [
     TrxnUserModule.register({

examples/api-prisma/src/casl/can/can-action-right.ts

@@ -0,0 +1,67 @@
+import { AbilityBuilder } from '@casl/ability';
+
+import { AppAbility } from '../types/app-ability';
+import { UserWithOwnershipIds } from '../types/user-with-ownership-ids';
+
+import { Action } from '@trxn/nestjs-casl';
+
+export function getAllRightIds(user: UserWithOwnershipIds) {
+  return user.role.rights.map((right) => right.id);
+}
+
+export function canReadRight(
+  abilities: AbilityBuilder<AppAbility>,
+  user: UserWithOwnershipIds,
+) {
+  abilities.can(Action.Read, 'Right', { id: { in: getAllRightIds(user) } });
+}
+export function canSearchRight(
+  abilities: AbilityBuilder<AppAbility>,
+  user: UserWithOwnershipIds,
+) {
+  abilities.can(Action.Search, 'Right', { id: { in: getAllRightIds(user) } });
+}
+export function canCountRight(
+  abilities: AbilityBuilder<AppAbility>,
+  user: UserWithOwnershipIds,
+) {
+  abilities.can(Action.Count, 'Right', { id: { in: getAllRightIds(user) } });
+}
+
+export function canCreateRight(
+  abilities: AbilityBuilder<AppAbility>,
+  user: UserWithOwnershipIds,
+) {
+  abilities.can(Action.Create, 'Right', { id: { in: getAllRightIds(user) } });
+}
+export function canUpdateRight(
+  abilities: AbilityBuilder<AppAbility>,
+  user: UserWithOwnershipIds,
+) {
+  abilities.can(Action.Update, 'Right', { id: { in: getAllRightIds(user) } });
+}
+export function canDeleteRight(
+  abilities: AbilityBuilder<AppAbility>,
+  user: UserWithOwnershipIds,
+) {
+  abilities.can(Action.Delete, 'Right', { id: { in: getAllRightIds(user) } });
+}
+
+export function canReadActionRight(
+  abilities: AbilityBuilder<AppAbility>,
+  user: UserWithOwnershipIds,
+) {
+  canReadRight(abilities, user);
+  canSearchRight(abilities, user);
+  canCountRight(abilities, user);
+}
+export function canWriteActionRight(
+  abilities: AbilityBuilder<AppAbility>,
+  user: UserWithOwnershipIds,
+  allowDelete = true,
+) {
+  canCreateRight(abilities, user);
+  canUpdateRight(abilities, user);
+
+  if (allowDelete) canDeleteRight(abilities, user);
+}

examples/api-prisma/src/casl/can/can-action-role.ts

@@ -0,0 +1,67 @@
+import { AbilityBuilder } from '@casl/ability';
+
+import { AppAbility } from '../types/app-ability';
+import { UserWithOwnershipIds } from '../types/user-with-ownership-ids';
+
+import { Action } from '@trxn/nestjs-casl';
+
+export function getAllRoleIds(user: UserWithOwnershipIds) {
+  return user.role.id;
+}
+
+export function canReadRole(
+  abilities: AbilityBuilder<AppAbility>,
+  user: UserWithOwnershipIds,
+) {
+  abilities.can(Action.Read, 'Role', { id: { in: getAllRoleIds(user) } });
+}
+export function canSearchRole(
+  abilities: AbilityBuilder<AppAbility>,
+  user: UserWithOwnershipIds,
+) {
+  abilities.can(Action.Search, 'Role', { id: { in: getAllRoleIds(user) } });
+}
+export function canCountRole(
+  abilities: AbilityBuilder<AppAbility>,
+  user: UserWithOwnershipIds,
+) {
+  abilities.can(Action.Count, 'Role', { id: { in: getAllRoleIds(user) } });
+}
+
+export function canCreateRole(
+  abilities: AbilityBuilder<AppAbility>,
+  user: UserWithOwnershipIds,
+) {
+  abilities.can(Action.Create, 'Role', { id: { in: getAllRoleIds(user) } });
+}
+export function canUpdateRole(
+  abilities: AbilityBuilder<AppAbility>,
+  user: UserWithOwnershipIds,
+) {
+  abilities.can(Action.Update, 'Role', { id: { in: getAllRoleIds(user) } });
+}
+export function canDeleteRole(
+  abilities: AbilityBuilder<AppAbility>,
+  user: UserWithOwnershipIds,
+) {
+  abilities.can(Action.Delete, 'Role', { id: { in: getAllRoleIds(user) } });
+}
+
+export function canReadActionRole(
+  abilities: AbilityBuilder<AppAbility>,
+  user: UserWithOwnershipIds,
+) {
+  canReadRole(abilities, user);
+  canSearchRole(abilities, user);
+  canCountRole(abilities, user);
+}
+export function canWriteActionRole(
+  abilities: AbilityBuilder<AppAbility>,
+  user: UserWithOwnershipIds,
+  allowDelete = true,
+) {
+  canCreateRole(abilities, user);
+  canUpdateRole(abilities, user);
+
+  if (allowDelete) canDeleteRole(abilities, user);
+}