sequelize scope inverse( exclude ) records - orm

Question

I have 2 models, entity and acl,
acl rules can be included/excluded and target is reference to entity ( or special case 'public' )
ACL:
const { DataTypes, Model } = require('sequelize');
class ACL extends Model {}
module.exports = (sequelize) => {
const attributes = {
id: {
type: DataTypes.INTEGER(11),
allowNull: false,
primaryKey: true,
autoIncrement: true,
},
object_unique_id: {
type: DataTypes.STRING(36),
allowNull: false,
},
principal_unique_id: {
type: DataTypes.STRING(36),
allowNull: false,
},
rule: {
type: DataTypes.INTEGER(11),
allowNull: false,
defaultValue: 1,
comment: '1=allow, 0=deny',
},
};
const options = {
modelName: 'acl',
tableName: 'acl',
sequelize, // We need to pass the connection instance
};
return ACL.init(attributes, options);
};
ENTITY:
const { DataTypes, Model } = require('sequelize');
const { Op } = require('sequelize');
class Entity extends Model {}
module.exports = (sequelize, ACL) => {
Entity.init(
{
id: {
type: DataTypes.INTEGER(11).UNSIGNED,
allowNull: false,
primaryKey: true,
autoIncrement: true,
},
unique_id: {
type: DataTypes.STRING(36),
allowNull: false,
},
name: {
type: DataTypes.STRING(50),
allowNull: false,
},
},
{
indexes: [
{
name: 'unique_id',
unique: true,
fields: ['unique_id'],
},
],
tableName: 'entity',
sequelize,
modelName: 'entity',
scopes: {
byPrincipalUID(principalUID) {
const includedCondition = [
{ principal_unique_id: 'public' },
];
if (principalUID) {
includedCondition.push({
principal_unique_id: principalUID,
});
}
return {
include: [
{
model: ACL,
where: {
[Op.and]: [
{ rule: 1 },
{ [Op.or]: includedCondition },
],
},
},
],
};
},
public: {
include: [
{
model: ACL,
where: {
[Op.and]: [
{ rule: 1 },
{ principal_unique_id: 'public' },
],
},
},
],
},
},
}
);
Entity.hasMany(ACL, {
sourceKey: 'unique_id',
foreignKey: 'object_unique_id',
});
return Entity;
};
test cases:
describe('AclService', () => {
it('should works with scopes', async () => {
const { Sequelize } = require('sequelize');
const sequelize = new Sequelize('sqlite::memory:');
const ACL = require('../db/models/acl.model')(sequelize);
const Entity = require('../db/models/entity.model')(sequelize, ACL);
await ACL.sync();
await Entity.sync();
await Entity.create({ name: 'test 1', unique_id: 's1' });
await Entity.create({ name: 'test 2', unique_id: 's2' });
await Entity.create({ name: 'test 3', unique_id: 's3' });
await ACL.create({
object_unique_id: 's1',
rule: 1,
principal_unique_id: 'public',
});
await ACL.create({
object_unique_id: 's2',
rule: 1,
principal_unique_id: 'c1',
});
await ACL.create({
object_unique_id: 's3',
rule: 1,
principal_unique_id: 'p1',
});
const all = await Entity.findAll();
expect(all.length).toBe(3);
const publicSubjects = await Entity.scope('public').findAll();
expect(publicSubjects.length).toBe(1);
const companySubjects = await Entity.scope({
method: ['byPrincipalUID', 'c1'],
}).findAll();
expect(companySubjects.length).toBe(2);
const accountSubjects = await Entity.scope({
method: ['byPrincipalUID', 'p1'],
}).findAll();
expect(accountSubjects.length).toBe(2);
});
it('should works with scopes and deny rule', async () => {
const { Sequelize } = require('sequelize');
const sequelize = new Sequelize('sqlite::memory:');
const ACL = require('../db/models/acl.model')(sequelize);
const Entity = require('../db/models/entity.model')(sequelize, ACL);
await ACL.sync();
await Entity.sync();
await Entity.create({ name: 'test 1', unique_id: 's1' });
await Entity.create({ name: 'test 2', unique_id: 's2' });
await ACL.create({
object_unique_id: 's1',
rule: 1,
principal_unique_id: 'public',
});
await ACL.create({
object_unique_id: 's2',
rule: 1,
principal_unique_id: 'public',
});
await ACL.create({
object_unique_id: 's2',
rule: 0,
principal_unique_id: 'c1',
});
const all = await Entity.findAll();
expect(all.length).toBe(2);
const publicSubjects = await Entity.scope('public').findAll();
expect(publicSubjects.length).toBe(2);
//s2 is denied for c1
const companySubjects = await Entity.scope({
method: ['byPrincipalUID', 'c1'],
}).findAll();
expect(companySubjects.length).toBe(1);
});
});
so with 'Grant' permission all works as expected.
But have no good ideas how to exclude 'Deny' records.
So in second test I have 2 'public' entities, but second one have "deny" rule for c1
I have only one idea, somehow use raw subquery something like
NOT EXISTS(SELECT id FROM acl
WHERE acl.object_unique_id = ${targetTable}.unique_id
AND (acl.rule = 0 AND (
.....
)
)
but not sure how to make it using sequelize