Access rules

import { graphql } from '@ultimabase/graphql'
import { allOf, allow, anyOf, defineModel } from 'ultimabase'
import type { Caller } from 'ultimabase'

/** The caller's user id, or `undefined` for anyone else. */
const userId = (caller: Caller) =>
	caller.kind === 'user' ? caller.user.id : undefined

export const Article = defineModel({
	name: 'Article',
	use: [graphql()],
	fields: (f) => ({
		title: f.string(),
		status: f.enumOf(['draft', 'published'], { default: 'draft' }),
		// Written once, with the caller's id: nobody signs for someone else.
		authorId: f.string({ default: ({ caller }) => userId(caller) }).with({
			access: {
				create: ({ caller, value }) => value === userId(caller),
				update: allow.private,
			},
		}),
		// The author's notes: other readers get the article without them.
		notes: f.string({ optional: true }).with<{ authorId: string }>({
			access: {
				read: ({ caller, record }) => record.authorId === userId(caller),
			},
		}),
		// Only the server features an article.
		featured: f.boolean({ default: false }).with({ access: allow.readOnly }),
	}),
}).with({
	access: {
		// Everyone reads what is published; an author reads their drafts too.
		read: anyOf(
			({ where }) => where({ status: 'published' }),
			({ caller, where }) =>
				caller.kind === 'user' && where({ authorId: caller.user.id }),
		),
		create: ({ caller }) => caller.kind === 'user',
		update: ({ caller, record }) => record.authorId === userId(caller),
		// An author deletes their own drafts, and nothing published.
		delete: allOf(
			({ caller, record }) => record.authorId === userId(caller),
			({ record }) => record.status === 'draft',
		),
	},
})

await Article.create(
	{ data: { title: 'Draft', notes: 'Check the dates.' } },
	ada,
)
await Article.create(
	{ data: { title: 'Launch', status: 'published', notes: 'Embargo.' } },
	ada,
)
// The filter joins the query: pages and counts stay exact.
expect(titles(await Article.findMany({}, ada))).toEqual(['Draft', 'Launch'])
expect(titles(await Article.findMany({}, grace))).toEqual(['Launch'])
expect(await Article.count({}, grace)).toBe(1)
// A field read rule hides the value, row by row.
const [launch] = await Article.findMany({}, grace)
expect(launch).not.toHaveProperty('notes')
// Nor can a filter guess it.
await expect(
	Article.findMany({ where: { notes: { contains: 'E' } } }, grace),
).rejects.toMatchObject({
	code: 'INVALID_QUERY',
	message:
		'where.notes: Article.notes has a read rule; only Master filters on it.',
})

const draft = await Article.create({ data: { title: 'Draft' } }, ada)
expect(draft.authorId).toBe('ada')

// Grace reads no draft of Ada's: for her, it does not exist.
await expect(
	Article.update({ where: { id: draft.id }, data: { title: 'Mine' } }, grace),
).rejects.toMatchObject({ code: 'NOT_FOUND' })

// A field rule: nobody signs an article for someone else.
await expect(
	Article.create({ data: { title: 'Fake', authorId: 'grace' } }, ada),
).rejects.toMatchObject({
	code: 'ACCESS_DENIED',
	message: 'Article create refused.',
	details: { model: 'Article', operation: 'create', field: 'authorId' },
})

// Published, the article can no longer be deleted by its author.
await Article.update(
	{ where: { id: draft.id }, data: { status: 'published' } },
	ada,
)
await expect(
	Article.delete({ where: { id: draft.id } }, ada),
).rejects.toMatchObject({
	code: 'ACCESS_DENIED',
	details: { model: 'Article', operation: 'delete' },
})

const draft = await Article.create({ data: { title: 'Draft' } }, ada)
await expect(
	Article.update({ where: { id: draft.id }, data: { featured: true } }, ada),
).rejects.toMatchObject({ code: 'ACCESS_DENIED' })
const featured = await Article.update(
	{ where: { id: draft.id }, data: { featured: true } },
	{ as: master },
)
expect(featured.featured).toBe(true)

const response = await fetch(`${running.url}/graphql`, {
	method: 'POST',
	headers: { 'content-type': 'application/json' },
	body: JSON.stringify({
		query: 'mutation { createArticle(data: { title: "Hi" }) { id } }',
	}),
})
expect(await response.json()).toMatchObject({
	errors: [
		{
			message: 'Article create refused.',
			extensions: { code: 'ACCESS_DENIED' },
		},
	],
})