119 lines
4.7 KiB
TypeScript
119 lines
4.7 KiB
TypeScript
import type { Context } from "@wrnexus/core";
|
|
import type { Db } from "@wrnexus/db";
|
|
import { can } from "@wrnexus/authz";
|
|
import { HttpError, defineApiRoute, json, requireJson, requireParam, requireUser } from "./http.ts";
|
|
|
|
const SAFE = /^[A-Za-z_][A-Za-z0-9_]*$/;
|
|
const ident = (value: string) => {
|
|
if (!SAFE.test(value)) throw new TypeError(`Unsafe resource identifier: ${value}`);
|
|
return value;
|
|
};
|
|
|
|
export interface ResourceDefinition<T extends Record<string, unknown>> {
|
|
name: string;
|
|
db: () => Db;
|
|
table: string;
|
|
id?: string;
|
|
owner?: string;
|
|
fields: readonly (keyof T & string)[];
|
|
permissions?: { read?: string; readAny?: string; write?: string; writeAny?: string };
|
|
validate?: (input: unknown, mode: "create" | "update") => T | Promise<T>;
|
|
serialize?: (row: T) => unknown;
|
|
}
|
|
|
|
export interface ResourceHandlers {
|
|
list(ctx: Context): Response | Promise<Response>;
|
|
create(ctx: Context): Response | Promise<Response>;
|
|
get(ctx: Context): Response | Promise<Response>;
|
|
update(ctx: Context): Response | Promise<Response>;
|
|
remove(ctx: Context): Response | Promise<Response>;
|
|
}
|
|
|
|
/** Build conventional owned CRUD handlers from one checked resource declaration. */
|
|
export function defineResource<T extends Record<string, unknown>>(
|
|
definition: ResourceDefinition<T>,
|
|
): ResourceHandlers {
|
|
const table = ident(definition.table);
|
|
const id = ident(definition.id ?? "id");
|
|
const owner = definition.owner ? ident(definition.owner) : undefined;
|
|
const fields = definition.fields.map(ident);
|
|
const shape = (row: T) => definition.serialize?.(row) ?? row;
|
|
const authorize = async (ctx: Context, action: "read" | "write", row?: T) => {
|
|
const subject = requireUser(ctx).id;
|
|
const permission = definition.permissions?.[action];
|
|
const any = definition.permissions?.[`${action}Any`];
|
|
if (any && (await can(ctx, any))) return subject;
|
|
if (
|
|
permission &&
|
|
!(await can(ctx, permission, owner ? { ownerId: row?.[owner] ?? subject } : row))
|
|
) {
|
|
throw new HttpError(403, "Forbidden");
|
|
}
|
|
if (owner && row && String(row[owner]) !== subject) throw new HttpError(403, "Forbidden");
|
|
return subject;
|
|
};
|
|
const find = async (ctx: Context) => {
|
|
const value = requireParam(ctx, id, { integer: true, positive: true });
|
|
const row = await definition.db().one<T>(`SELECT * FROM ${table} WHERE ${id} = ?`, [value]);
|
|
if (!row) throw new HttpError(404, `${definition.name} not found`);
|
|
return row;
|
|
};
|
|
return {
|
|
list: defineApiRoute(async (ctx) => {
|
|
const subject = await authorize(ctx, "read");
|
|
const seeAll =
|
|
definition.permissions?.readAny && (await can(ctx, definition.permissions.readAny));
|
|
const rows = await definition
|
|
.db()
|
|
.all<T>(
|
|
`SELECT * FROM ${table}${owner && !seeAll ? ` WHERE ${owner} = ?` : ""} ORDER BY ${id} DESC`,
|
|
owner && !seeAll ? [subject] : [],
|
|
);
|
|
return json.ok({ [definition.name]: rows.map(shape) });
|
|
}),
|
|
create: defineApiRoute(async (ctx) => {
|
|
const subject = await authorize(ctx, "write");
|
|
const input = definition.validate
|
|
? await definition.validate(await requireJson(ctx), "create")
|
|
: await requireJson<T>(ctx);
|
|
const values = Object.fromEntries(
|
|
fields.filter((key) => key in input).map((key) => [key, input[key]]),
|
|
);
|
|
if (owner) values[owner] = subject;
|
|
const columns = Object.keys(values).map(ident);
|
|
const result = await definition.db().exec(
|
|
`INSERT INTO ${table} (${columns.join(", ")}) VALUES (${columns.map(() => "?").join(", ")})`,
|
|
columns.map((key) => values[key]),
|
|
);
|
|
return json.created({ ok: true, id: result.lastInsertId });
|
|
}),
|
|
get: defineApiRoute(async (ctx) => {
|
|
const row = await find(ctx);
|
|
await authorize(ctx, "read", row);
|
|
return json.ok({ [definition.name.replace(/s$/, "")]: shape(row) });
|
|
}),
|
|
update: defineApiRoute(async (ctx) => {
|
|
const row = await find(ctx);
|
|
await authorize(ctx, "write", row);
|
|
const input = definition.validate
|
|
? await definition.validate(await requireJson(ctx), "update")
|
|
: await requireJson<T>(ctx);
|
|
const keys = fields.filter((key) => key in input);
|
|
if (!keys.length) throw new HttpError(400, "No writable fields supplied.");
|
|
await definition
|
|
.db()
|
|
.exec(`UPDATE ${table} SET ${keys.map((key) => `${key} = ?`).join(", ")} WHERE ${id} = ?`, [
|
|
...keys.map((key) => input[key]),
|
|
row[id],
|
|
]);
|
|
return json.ok({ ok: true });
|
|
}),
|
|
remove: defineApiRoute(async (ctx) => {
|
|
const row = await find(ctx);
|
|
await authorize(ctx, "write", row);
|
|
await definition.db().exec(`DELETE FROM ${table} WHERE ${id} = ?`, [row[id]]);
|
|
return json.ok({ ok: true });
|
|
}),
|
|
};
|
|
}
|