Access Control

export type SonicJSConfig = {
  tablesConfig: ApiConfig[];
  adminAccessControl: (ctx: AppContext) => boolean;
};

The config defines access control rules for each table endpoint. 

### Users Table

The users table has more complex access control since it stores user account data:

- Operation Access:
  - Create is restricted to admins only
  - Delete is restricted to admins only

- Item Level Access:
  - Update checks if the user is an admin or updating their own user account via the `isAdminOrUser` function

- Field Level Access: 
  - Id, email, password, role have detailed field level access control:

    - Id:
      - Read access allowed for admin/editors or user reading their own id

    - Email: 
      - Read access allowed only for admin/user reading their own email

    - Password:
      - Update allowed for admin/user updating their own password  

    - Role:
      - Read access allowed for admin/user reading their own role
      - Update restricted to just admins

So in summary:

- CRUD is restricted for normal users
- Users can view/update their own user account
- Admins have full access
- Sensitive fields like role, email are protected from unauthorized access

### Posts Table

- Operation Access:
  - Read is allowed for everyone (set to true)
  - Create is allowed only for admins and editors via the `isAdminOrEditor` function
- Filter Access: 
  - Updates and deletes apply a filter to restrict access based on the userId not matching the logged in user. This prevents unauthorized updates/deletes.

- Field Level Access:
  - The userId field cannot be updated directly. This prevents changing the post owner.

- Hooks:
  - On create/update, it will set the userId field based on the logged in user.


export const apiConfig: ApiConfig[] = [
  {
    table: "posts",
    route: "posts",
    access: {
      operation: {
        read: true,
        create: isAdminOrEditor,
      },
      filter: {
        // if a user tries to update a post and isn't the user that created the post the update won't happen
        update: (ctx) => {
          if (isAdmin(ctx)) {
            return true;
          } else {
            const user = ctx.get("user");
            if (user?.userId) {
              // Return filter so update doesn't happen if userId doesn't match
              return {
                userId: user.userId,
              };
            } else {
              return false;
            }
          }
        },
        delete: (ctx) => {
          if (isAdmin(ctx)) {
            return true;
          } else {
            const user = ctx.get("user");
            if (user?.userId) {
              // Return filter so update doesn't happen if userId doesn't match
              return {
                userId: user.userId,
              };
            } else {
              return false;
            }
          }
        },
      },
      fields: {
        userId: {
          update: false,
        },
      },
    },
    hooks: {
      resolveInput: {
        create: (ctx, data) => {
          if (ctx.get("user")?.userId) {
            data.userId = ctx.get("user").userId;
          }
          return data;
        },
        update: (ctx, id, data) => {
          if (ctx.get("user")?.userId) {
            data.userId = ctx.get("user").userId;
          }
          return data;
        },
      },
    },
  },
  {
    table: "categories",
    route: "categories",
    access: {
      operation: {
        read: true,
        create: true,
        update: isAdminOrEditor,
        delete: isAdminOrEditor,
      },
    },
  },
  {
    table: "comments",
    route: "comments",
    access: {
      operation: {
        read: true,
        create: true,
        update: isAdminOrUser,
        delete: isAdminOrUser,
      },
    },
  },
  {
    table: "categoriesToPosts",
    route: "categories-to-posts",
    access: {
      operation: {
        read: true,
        create: true,
        update: isAdminOrEditor,
        delete: isAdminOrEditor,
      },
    },
  },
  {
    table: "users",
    route: "users",
    access: {
      operation: {
        create: isAdmin,
        delete: isAdmin,
      },
      item: {
        // if a user tries to update a user and isn't the user that created the user the update will return unauthorized response
        update: isAdminOrUser,
      },
      fields: {
        id: {
          read: (ctx, value, doc) => {
            return isAdminOrEditor(ctx) || isAdminOrUser(ctx, doc.id);
          },
        },
        email: {
          read: (ctx, value, doc) => {
            return isAdminOrUser(ctx, doc.id);
          },
        },
        password: {
          update: isAdminOrUser,
        },
        role: {
          read: (ctx, value, doc) => {
            return isAdminOrUser(ctx, doc.id);
          },
          update: isAdmin,
        },
      },
    },
  },
];


export function isAdminOrEditor(ctx: AppContext) {
  const user = ctx.get("user");
  const role = user?.role?.toLowerCase() || "";
  if (role === "admin" || role === "editor") {
    return true;
  }
  return false;
}

export function isAdmin(ctx: AppContext) {
  const user = ctx.get("user");
  const role = user?.role?.toLowerCase() || "";
  if (role === "admin") {
    return true;
  }
  return false;
}

export function isUser(ctx: AppContext, id: string) {
  const user = ctx.get("user");
  return user.userId === id;
}

export function isAdminOrUser(ctx: AppContext, id: string) {
  return isAdmin(ctx) || isUser(ctx, id);
}