ackeecz / axesor Goto Github PK

I would like to do something like this: ['*', '!name'] - allow all fields but exclude name from it. It seems to be not working.

Is calling owner function for each match in grant intended feature or a bug? Example:

const axesor = require('axesor');

const grants = {
  admin: {
    video: {
      'read:own': ['*']
    }
  },
  reader: {
    video: {
      'read:own': ['*']
    }
  }
} 

const options = {
    getRoles: () => ['admin', 'reader'],
    ownerFunctions: {
      video: () => {
        console.log('video owner function')
      }
    }
};

const ac = new axesor.Acl(grants, options);

ac.can({}).read({ title: 'test' }, 'video');

video owner function is called twice in that case

https://repl.it/join/yvpignqp-jevhenijhorvat

This issue is side effect of the issue #6.

The part of code attributes: !attributes.includes('*') ? attributes : ['*'] in the Acl.ts on the line 116 was changed.

Now permission attributes will look like this: ['*', 'author', 'title'] if you grant access to the ['*', 'author', 'title']. The previous part of code should not be here because of exclude filters - ['*', '!name'] - result was ['*'].

We need to add some filter for this cases. If grants contains exclude then keep attributes and if not then use the * (only if * is defined).