Support SeaORM RBAC (#212)

tyt2y3 · tyt2y3 · commit be8929e8c01a · 2025-08-27T09:47:52.000+01:00
* Support rbac: unrestricted by default

* Use generic inplace of RestrictedConnection in public API

* guard behind feature flag `rbac`
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
@@ -82,7 +82,9 @@ jobs:
       - name: Additional Integration tests
         working-directory: ./examples/sqlite
         run: |
-          cargo test --tests custom_
+          cargo test --test custom_query_tests
+          cargo test --test custom_mutation_tests
+          cargo test --test query_tests --features=rbac
           cargo test --test plural_query_tests --features=field-pluralize
           cargo test --test entity_filter_tests --features=field-pluralize
           rm tests/custom_mutation_tests.rs tests/custom_query_tests.rs tests/plural_query_tests.rs
diff --git a/Cargo.toml b/Cargo.toml
@@ -30,6 +30,7 @@ pluralizer = { version = "0.5", optional = true }
 [features]
 default = ["field-camel-case"]
 macros = ["seaography-macros"]
+rbac = ["sea-orm/rbac"]
 with-json = ["sea-orm/with-json"]
 with-chrono = ["sea-orm/with-chrono", "async-graphql/chrono"]
 with-time = ["sea-orm/with-time", "async-graphql/time"]
diff --git a/examples/sqlite/Cargo.toml b/examples/sqlite/Cargo.toml
@@ -25,6 +25,7 @@ serde_json = { version = "1.0.103" }
 members = []
 
 [features]
+rbac = ["seaography/rbac"]
 field-pluralize = ["seaography/field-pluralize"]
 
 [[test]]
diff --git a/examples/sqlite/src/query_root/queries.rs b/examples/sqlite/src/query_root/queries.rs
@@ -1,8 +1,7 @@
 use super::*;
 use async_graphql::Result as GqlResult;
 use sea_orm::{ColumnTrait, EntityTrait, QueryFilter};
-use seaography::apply_pagination;
-use seaography::{macros::CustomOperation, Connection, PaginationInput};
+use seaography::{apply_pagination, macros::CustomOperation, Connection, PaginationInput};
 
 /*
 
@@ -37,8 +36,9 @@ impl Operations {
         pagination: PaginationInput,
     ) -> GqlResult<Connection<customer::Entity>> {
         let db = ctx.data::<DatabaseConnection>()?;
+
         let query = customer::Entity::find().filter(customer::Column::StoreId.eq(2));
-        let connection = apply_pagination::<customer::Entity>(db, query, pagination).await?;
+        let connection = apply_pagination::<customer::Entity, _>(db, query, pagination).await?;
 
         Ok(connection)
     }
diff --git a/examples/sqlite/tests/query_tests.rs b/examples/sqlite/tests/query_tests.rs
@@ -1,10 +1,11 @@
 use async_graphql::{dynamic::*, Response};
 use sea_orm::Database;
-use seaography::async_graphql;
+use seaography::{async_graphql, DatabaseContext};
 
 pub async fn get_schema() -> Schema {
     let database = Database::connect("sqlite://sakila.db").await.unwrap();
-    let schema = seaography_sqlite_example::query_root::schema(database, None, None).unwrap();
+    let schema =
+        seaography_sqlite_example::query_root::schema(database.unrestricted(), None, None).unwrap();
 
     schema
 }
diff --git a/src/lib.rs b/src/lib.rs
@@ -264,6 +264,9 @@ pub use builder::*;
 pub mod error;
 pub use error::*;
 
+pub mod rbac;
+pub use rbac::*;
+
 pub type SimpleNamingFn = Box<dyn Fn(&str) -> String + Sync + Send>;
 pub type ComplexNamingFn = Box<dyn Fn(&str, &str) -> String + Sync + Send>;
 
diff --git a/src/mutation/entity_create_batch_mutation.rs b/src/mutation/entity_create_batch_mutation.rs
@@ -4,8 +4,9 @@ use sea_orm::{
 };
 
 use crate::{
-    apply_guard, guard_error, prepare_active_model, BuilderContext, EntityInputBuilder,
-    EntityObjectBuilder, EntityQueryFieldBuilder, GuardAction, OperationType,
+    apply_guard, guard_error, prepare_active_model, BuilderContext, DatabaseContext,
+    EntityInputBuilder, EntityObjectBuilder, EntityQueryFieldBuilder, GuardAction, OperationType,
+    UserContext,
 };
 
 /// The configuration structure of EntityCreateBatchMutationBuilder
@@ -90,7 +91,10 @@ impl EntityCreateBatchMutationBuilder {
                         return Err(guard_error(reason, "Entity guard triggered."));
                     }
 
-                    let db = ctx.data::<DatabaseConnection>()?;
+                    let db = &ctx
+                        .data::<DatabaseConnection>()?
+                        .restricted(ctx.data_opt::<UserContext>())?;
+
                     let transaction = db.begin().await?;
 
                     let entity_input_builder = EntityInputBuilder { context };
diff --git a/src/mutation/entity_create_one_mutation.rs b/src/mutation/entity_create_one_mutation.rs
@@ -5,8 +5,8 @@ use sea_orm::{
 };
 
 use crate::{
-    apply_guard, guard_error, BuilderContext, EntityInputBuilder, EntityObjectBuilder,
-    EntityQueryFieldBuilder, GuardAction, OperationType,
+    apply_guard, guard_error, BuilderContext, DatabaseContext, EntityInputBuilder,
+    EntityObjectBuilder, EntityQueryFieldBuilder, GuardAction, OperationType, UserContext,
 };
 
 /// The configuration structure of EntityCreateOneMutationBuilder
@@ -93,7 +93,6 @@ impl EntityCreateOneMutationBuilder {
 
                     let entity_input_builder = EntityInputBuilder { context };
                     let entity_object_builder = EntityObjectBuilder { context };
-                    let db = ctx.data::<DatabaseConnection>()?;
                     let value_accessor = ctx
                         .args
                         .try_get(&context.entity_create_one_mutation.data_field)?;
@@ -115,6 +114,10 @@ impl EntityCreateOneMutationBuilder {
                         }
                     }
 
+                    let db = &ctx
+                        .data::<DatabaseConnection>()?
+                        .restricted(ctx.data_opt::<UserContext>())?;
+
                     let active_model = prepare_active_model::<T, A>(
                         &entity_input_builder,
                         &entity_object_builder,
diff --git a/src/mutation/entity_delete_mutation.rs b/src/mutation/entity_delete_mutation.rs
@@ -4,8 +4,9 @@ use sea_orm::{
 };
 
 use crate::{
-    apply_guard, get_filter_conditions, guard_error, BuilderContext, EntityObjectBuilder,
-    EntityQueryFieldBuilder, FilterInputBuilder, GuardAction, OperationType,
+    apply_guard, get_filter_conditions, guard_error, BuilderContext, DatabaseContext,
+    EntityObjectBuilder, EntityQueryFieldBuilder, FilterInputBuilder, GuardAction, OperationType,
+    UserContext,
 };
 
 /// The configuration structure of EntityDeleteMutationBuilder
@@ -90,7 +91,9 @@ impl EntityDeleteMutationBuilder {
                         return Err(guard_error(reason, "Entity guard triggered."));
                     }
 
-                    let db = ctx.data::<DatabaseConnection>()?;
+                    let db = &ctx
+                        .data::<DatabaseConnection>()?
+                        .restricted(ctx.data_opt::<UserContext>())?;
 
                     let filters = ctx.args.get(&context.entity_delete_mutation.filter_field);
                     let filter_condition = get_filter_conditions::<T>(context, filters)?;
diff --git a/src/mutation/entity_update_mutation.rs b/src/mutation/entity_update_mutation.rs
@@ -6,8 +6,8 @@ use sea_orm::{
 
 use crate::{
     apply_guard, get_filter_conditions, guard_error, prepare_active_model, BuilderContext,
-    EntityInputBuilder, EntityObjectBuilder, EntityQueryFieldBuilder, FilterInputBuilder,
-    GuardAction, OperationType,
+    DatabaseContext, EntityInputBuilder, EntityObjectBuilder, EntityQueryFieldBuilder,
+    FilterInputBuilder, GuardAction, OperationType, UserContext,
 };
 
 /// The configuration structure of EntityUpdateMutationBuilder
@@ -101,7 +101,10 @@ impl EntityUpdateMutationBuilder {
                         return Err(guard_error(reason, "Entity guard triggered."));
                     }
 
-                    let db = ctx.data::<DatabaseConnection>()?;
+                    let db = ctx
+                        .data::<DatabaseConnection>()?
+                        .restricted(ctx.data_opt::<UserContext>())?;
+
                     let transaction = db.begin().await?;
 
                     let entity_input_builder = EntityInputBuilder { context };
diff --git a/src/query/entity_object_relation.rs b/src/query/entity_object_relation.rs
@@ -3,13 +3,15 @@ use async_graphql::{
     dynamic::{Field, FieldFuture, FieldValue, InputValue, TypeRef},
 };
 use heck::{ToLowerCamelCase, ToSnakeCase};
-use sea_orm::{EntityTrait, Iden, ModelTrait, QueryFilter, RelationDef};
+use sea_orm::{
+    DatabaseConnection, EntityTrait, Iden, ModelTrait, QueryFilter, QueryTrait, RelationDef,
+};
 
 use crate::{
     apply_guard, apply_memory_pagination, get_filter_conditions, guard_error, pluralize_unique,
-    BuilderContext, Connection, ConnectionObjectBuilder, EntityObjectBuilder, FilterInputBuilder,
-    GuardAction, HashableGroupKey, KeyComplex, OneToManyLoader, OneToOneLoader, OperationType,
-    OrderInputBuilder, PaginationInputBuilder,
+    BuilderContext, Connection, ConnectionObjectBuilder, DatabaseContext, EntityObjectBuilder,
+    FilterInputBuilder, GuardAction, HashableGroupKey, KeyComplex, OneToManyLoader, OneToOneLoader,
+    OperationType, OrderInputBuilder, PaginationInputBuilder, UserContext,
 };
 
 /// This builder produces a GraphQL field for an SeaORM entity relationship
@@ -105,6 +107,12 @@ impl EntityObjectRelationBuilder {
                         stmt = stmt.filter(filter);
                     }
 
+                    let db = ctx
+                        .data::<DatabaseConnection>()?
+                        .restricted(ctx.data_opt::<UserContext>())?;
+
+                    db.user_can_run(stmt.as_query())?;
+
                     let filters = ctx.args.get(&context.entity_query_field.filters);
                     let filters = get_filter_conditions::<R>(context, filters)?;
                     let order_by = ctx.args.get(&context.entity_query_field.order_by);
@@ -167,6 +175,12 @@ impl EntityObjectRelationBuilder {
                             stmt = stmt.filter(filter);
                         }
 
+                        let db = &ctx
+                            .data::<DatabaseConnection>()?
+                            .restricted(ctx.data_opt::<UserContext>())?;
+
+                        db.user_can_run(stmt.as_query())?;
+
                         let filters = ctx.args.get(&context.entity_query_field.filters);
                         let filters = get_filter_conditions::<R>(context, filters)?;
                         let order_by = ctx.args.get(&context.entity_query_field.order_by);
diff --git a/src/query/entity_object_via_relation.rs b/src/query/entity_object_via_relation.rs
@@ -4,14 +4,16 @@ use async_graphql::{
 };
 use heck::{ToLowerCamelCase, ToSnakeCase};
 use sea_orm::{
-    ColumnTrait, Condition, DatabaseConnection, EntityTrait, Iden, ModelTrait, QueryFilter, Related,
+    ColumnTrait, Condition, DatabaseConnection, EntityTrait, Iden, ModelTrait, QueryFilter,
+    QueryTrait, Related,
 };
 
 use crate::{
     apply_guard, apply_memory_pagination, apply_order, apply_pagination, get_filter_conditions,
-    guard_error, pluralize_unique, BuilderContext, ConnectionObjectBuilder, EntityObjectBuilder,
-    FilterInputBuilder, GuardAction, HashableGroupKey, KeyComplex, OneToManyLoader, OneToOneLoader,
-    OperationType, OrderInputBuilder, PaginationInputBuilder,
+    guard_error, pluralize_unique, BuilderContext, ConnectionObjectBuilder, DatabaseContext,
+    EntityObjectBuilder, FilterInputBuilder, GuardAction, HashableGroupKey, KeyComplex,
+    OneToManyLoader, OneToOneLoader, OperationType, OrderInputBuilder, PaginationInputBuilder,
+    UserContext,
 };
 
 /// This builder produces a GraphQL field for an SeaORM entity related trait
@@ -120,6 +122,12 @@ impl EntityObjectViaRelationBuilder {
                         stmt = stmt.filter(filter);
                     }
 
+                    let db = ctx
+                        .data::<DatabaseConnection>()?
+                        .restricted(ctx.data_opt::<UserContext>())?;
+
+                    db.user_can_run(stmt.as_query())?;
+
                     let filters = ctx.args.get(&context.entity_query_field.filters);
                     let filters = get_filter_conditions::<R>(context, filters)?;
                     let order_by = ctx.args.get(&context.entity_query_field.order_by);
@@ -196,18 +204,22 @@ impl EntityObjectViaRelationBuilder {
                         let pagination =
                             PaginationInputBuilder { context }.parse_object(pagination)?;
 
-                        let db = ctx.data::<DatabaseConnection>()?;
+                        let db = &ctx
+                            .data::<DatabaseConnection>()?
+                            .restricted(ctx.data_opt::<UserContext>())?;
 
                         let connection = if is_via_relation {
                             // TODO optimize query
                             let condition = Condition::all().add(from_col.eq(parent.get(from_col)));
 
                             let stmt = stmt.filter(condition.add(filters));
                             let stmt = apply_order(stmt, order_by);
-                            apply_pagination::<R>(db, stmt, pagination).await?
+                            apply_pagination::<R, _>(db, stmt, pagination).await?
                         } else {
                             let loader = ctx.data_unchecked::<DataLoader<OneToManyLoader<R>>>();
 
+                            db.user_can_run(stmt.as_query())?;
+
                             let key = KeyComplex::<R> {
                                 key: vec![parent.get(from_col)],
                                 meta: HashableGroupKey::<R> {
diff --git a/src/query/entity_query_field.rs b/src/query/entity_query_field.rs
@@ -4,8 +4,9 @@ use sea_orm::{DatabaseConnection, EntityTrait, QueryFilter};
 
 use crate::{
     apply_guard, apply_order, apply_pagination, get_filter_conditions, guard_error,
-    pluralize_unique, BuilderContext, ConnectionObjectBuilder, EntityObjectBuilder,
-    FilterInputBuilder, GuardAction, OperationType, OrderInputBuilder, PaginationInputBuilder,
+    pluralize_unique, BuilderContext, ConnectionObjectBuilder, DatabaseContext,
+    EntityObjectBuilder, FilterInputBuilder, GuardAction, OperationType, OrderInputBuilder,
+    PaginationInputBuilder, UserContext,
 };
 
 /// The configuration structure for EntityQueryFieldBuilder
@@ -146,7 +147,9 @@ impl EntityQueryFieldBuilder {
                         stmt = stmt.filter(column.eq(v));
                     }
 
-                    let db = ctx.data::<DatabaseConnection>()?;
+                    let db = &ctx
+                        .data::<DatabaseConnection>()?
+                        .restricted(ctx.data_opt::<UserContext>())?;
 
                     let r = stmt.one(db).await?;
 
@@ -214,9 +217,11 @@ impl EntityQueryFieldBuilder {
                 stmt = stmt.filter(filters);
                 stmt = apply_order(stmt, order_by);
 
-                let db = ctx.data::<DatabaseConnection>()?;
+                let db = &ctx
+                    .data::<DatabaseConnection>()?
+                    .restricted(ctx.data_opt::<UserContext>())?;
 
-                let connection = apply_pagination::<T>(db, stmt, pagination).await?;
+                let connection = apply_pagination::<T, _>(db, stmt, pagination).await?;
 
                 Ok(Some(FieldValue::owned_any(connection)))
             })
diff --git a/src/query/pagination.rs b/src/query/pagination.rs
@@ -1,7 +1,7 @@
 use itertools::Itertools;
 use sea_orm::{
-    ConnectionTrait, DatabaseConnection, EntityTrait, Iterable, ModelTrait, PaginatorTrait,
-    PrimaryKeyArity, PrimaryKeyToColumn, PrimaryKeyTrait, QuerySelect, QueryTrait, Select,
+    ConnectionTrait, EntityTrait, Iterable, ModelTrait, PaginatorTrait, PrimaryKeyArity,
+    PrimaryKeyToColumn, PrimaryKeyTrait, QuerySelect, QueryTrait, Select,
 };
 
 use crate::{
@@ -10,14 +10,15 @@ use crate::{
 };
 
 /// used to parse pagination input object and apply it to statement
-pub async fn apply_pagination<T>(
-    db: &DatabaseConnection,
+pub async fn apply_pagination<T, C>(
+    db: &C,
     stmt: Select<T>,
     pagination: PaginationInput,
 ) -> Result<Connection<T>, sea_orm::DbErr>
 where
     T: EntityTrait,
     <T as EntityTrait>::Model: Sync,
+    C: ConnectionTrait,
 {
     if let Some(cursor_object) = pagination.cursor {
         let next_stmt = stmt.clone();
diff --git a/src/rbac.rs b/src/rbac.rs
