#acl snippets

ACL defined in content entities

model.ts

import { c } from '@contember/schema-definition'
export const memberRole = c.createRole('member')
export const personIdVariable = c.createPredefinedVariable('personId', 'personID', memberRole)
export class User {
name = c.stringColumn().notNull()
personId = c.uuidColumn().notNull().unique()
teams = c.manyHasMany(Team, 'members')
projects = c.oneHasMany(ProjectUserAccess, 'user')
}
export class Team {
name = c.stringColumn().notNull()
members = c.manyHasManyInverse(User, 'teams')
projects = c.oneHasMany(ProjectTeamAccess, 'team')
}
@c.Allow(memberRole, {
when: {
or: [
{
teams: {
team: {
members: {
personId: personIdVariable,
},
},
},
},
{
members: {
user: {
personId: personIdVariable,
},
},
},
],
},
read: true,
})
@c.Allow(memberRole, {
when: {
or: [
{
teams: {
team: {
members: {
personId: personIdVariable,
},
},
permissions: { eq: 'write' },
},
},
{
members: {
user: {
personId: personIdVariable,
},
permissions: { eq: 'write' },
},
},
],
},
update: true,
})
export class Project {
name = c.stringColumn().notNull()
members = c.oneHasMany(ProjectUserAccess, 'project')
teams = c.oneHasMany(ProjectTeamAccess, 'project')
tasks = c.oneHasMany(Task, 'project')
}
export const AccessPermission = c.createEnum('read', 'write')
export class ProjectUserAccess {
project = c.manyHasOne(Project, 'members').notNull().cascadeOnDelete()
user = c.manyHasOne(User, 'projects').notNull().cascadeOnDelete()
permissions = c.enumColumn(AccessPermission).notNull()
}
export class ProjectTeamAccess {
project = c.manyHasOne(Project, 'teams').notNull().cascadeOnDelete()
team = c.manyHasOne(Team, 'projects').notNull().cascadeOnDelete()
permissions = c.enumColumn(AccessPermission).notNull()
}
@c.Allow(memberRole, {
when: {
project: c.canRead('tasks'),
},
read: true,
})
@c.Allow(memberRole, {
when: {
project: c.canUpdate('tasks'),
},
delete: true,
update: true,
create: true,
})
export class Task {
title = c.stringColumn().notNull()
description = c.stringColumn().notNull()
project = c.manyHasOne(Project, 'tasks')
}