feat: add transformer and refactor graphql guards

.cargo/config.toml

@@ -2,32 +2,9 @@
 recorder-playground = "run -p recorder  --example playground -- --environment development"
 
 [build]
-rustflags = ["-Zthreads=8", "--cfg", "feature=\"testcontainers\""]
-
-[target.x86_64-unknown-linux-gnu]
-linker = "clang"
-rustflags = ["-Zthreads=8", "-Clink-arg=-fuse-ld=lld", "-Zshare-generics=y"]
-
-[target.x86_64-pc-windows-msvc]
-linker = "rust-lld.exe"
-rustflags = ["-Zthreads=8", "-Zshare-generics=n"]
-
-# NOTE: you must install [Mach-O LLD Port](https://lld.llvm.org/MachO/index.html) on mac. you can easily do this by installing llvm which includes lld with the "brew" package manager:
-# `brew install llvm`
-#[target.x86_64-apple-darwin]
-#rustflags = [
-#    "-Zthreads=8",
-#    "-C",
-#    "link-arg=-fuse-ld=/usr/local/opt/llvm/bin/ld64.lld",
-#    "-Zshare-generics=y",
-#]
-
-# NOTE: you must install [Mach-O LLD Port](https://lld.llvm.org/MachO/index.html) on mac. you can easily do this by installing llvm which includes lld with the "brew" package manager:
-# `brew install llvm`
-#[target.aarch64-apple-darwin]
-#rustflags = [
-#    "-Zthreads=8",
-#    "-C",
-#    "link-arg=-fuse-ld=/opt/homebrew/opt/llvm/bin/ld64.lld",
-#    "-Zshare-generics=y",
-#]
+rustflags = [
+    "-Zthreads=8",
+    "--cfg",
+    "feature=\"testcontainers\"",
+    "-Zshare-generics=y",
+]

.vscode/settings.json

@@ -28,5 +28,18 @@
   "emmet.showExpandedAbbreviation": "never",
   "prettier.enable": false,
   "typescript.tsdk": "node_modules/typescript/lib",
-  "rust-analyzer.cargo.features": ["testcontainers"]
+  "rust-analyzer.cargo.features": [
+    "testcontainers"
+  ],
+  "sqltools.connections": [
+    {
+      "previewLimit": 50,
+      "server": "localhost",
+      "port": 5432,
+      "driver": "PostgreSQL",
+      "name": "konobangu-dev",
+      "database": "konobangu",
+      "username": "konobangu"
+    }
+  ]
 }

Cargo.lock

@@ -5632,8 +5632,7 @@ checksum = "1c107b6f4780854c8b126e228ea8869f4d7b71260f962fefb57b996b8959ba6b"
 [[package]]
 name = "seaography"
 version = "1.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f5e0455935e4f31eb64ce606d9963715efd4c1856edb129619126f6b5372fcf"
+source = "git+https://github.com/lonelyhentxi/seaography.git?rev=0c4cc5c#0c4cc5ccd43730338802f98401120d5faeccd096"
 dependencies = [
  "async-graphql",
  "fnv",

Cargo.toml

@@ -50,3 +50,4 @@ recorder = { path = "./apps/recorder" }
 
 [patch.crates-io]
 jwt-authorizer = { git = "https://github.com/blablacio/jwt-authorizer.git", rev = "e956774" }
+seaography = { git = "https://github.com/lonelyhentxi/seaography.git", rev = "0c4cc5c" }

apps/recorder/.env

@@ -1,8 +1,8 @@
-AUTH_TYPE = "basic" # or oidc
+AUTH_TYPE = "oidc" # or oidc
 BASIC_USER = "konobangu"
 BASIC_PASSWORD = "konobangu"
-# OIDC_ISSUER="https://auth.logto.io/oidc"
-# OIDC_API_AUDIENCE = "https://konobangu.com/api"
-# OIDC_CLIENT_ID = "client_id"
-# OIDC_CLIENT_SECRET = "client_secret" # optional
-# OIDC_EXTRA_SCOPES = "read:konobangu write:konobangu"
+OIDC_ISSUER="https://auth.logto.io/oidc"
+OIDC_AUDIENCE = "https://konobangu.com/api"
+OIDC_CLIENT_ID = "client_id"
+OIDC_CLIENT_SECRET = "client_secret" # optional
+OIDC_EXTRA_SCOPES = "read:konobangu write:konobangu"

apps/recorder/src/graphql/guard.rs

@@ -4,11 +4,8 @@ use async_graphql::dynamic::{ResolverContext, ValueAccessor};
 use sea_orm::EntityTrait;
 use seaography::{BuilderContext, FnGuard, GuardAction};
 
-use super::util::get_entity_key;
-use crate::{
-    auth::{AuthError, AuthUserInfo},
-    graphql::util::get_column_key,
-};
+use super::util::{get_column_key, get_entity_key};
+use crate::auth::{AuthError, AuthUserInfo};
 
 fn guard_data_object_accessor_with_subscriber_id(
     value: ValueAccessor<'_>,
@@ -50,27 +47,20 @@ fn guard_data_object_accessor_with_optional_subscriber_id(
     }
 }
 
-fn guard_filter_object_accessor_with_subscriber_id(
-    value: ValueAccessor<'_>,
-    column_name: &str,
-    subscriber_id: i32,
-) -> async_graphql::Result<()> {
-    let obj = value.object()?;
-    let subscriber_id_filter_input_value = obj.try_get(column_name)?;
-
-    let subscriber_id_filter_input_obj = subscriber_id_filter_input_value.object()?;
-
-    let subscriber_id_value = subscriber_id_filter_input_obj.try_get("eq")?;
-
-    let id = subscriber_id_value.i64()?;
-    if id == subscriber_id as i64 {
-        Ok(())
-    } else {
-        Err(async_graphql::Error::new("subscriber not match"))
-    }
+pub fn guard_entity_with_subscriber_id<T>(_context: &BuilderContext, _column: &T::Column) -> FnGuard
+where
+    T: EntityTrait,
+    <T as EntityTrait>::Model: Sync,
+{
+    Box::new(move |context: &ResolverContext| -> GuardAction {
+        match context.ctx.data::<AuthUserInfo>() {
+            Ok(_) => GuardAction::Allow,
+            Err(err) => GuardAction::Block(Some(err.message)),
+        }
+    })
 }
 
-pub fn guard_entity_with_subscriber_id<T>(context: &BuilderContext, column: &T::Column) -> FnGuard
+pub fn guard_field_with_subscriber_id<T>(context: &BuilderContext, column: &T::Column) -> FnGuard
 where
     T: EntityTrait,
     <T as EntityTrait>::Model: Sync,
@@ -95,23 +85,13 @@ where
     ));
     let entity_create_batch_mutation_data_field_name =
         Arc::new(context.entity_create_batch_mutation.data_field.clone());
-    let entity_delete_mutation_field_name = Arc::new(format!(
-        "{}{}",
-        entity_name,
-        context.entity_delete_mutation.mutation_suffix.clone()
-    ));
-    let entity_delete_mutation_filter_field_name =
-        Arc::new(context.entity_delete_mutation.filter_field.clone());
     let entity_update_mutation_field_name = Arc::new(format!(
         "{}{}",
         entity_name, context.entity_update_mutation.mutation_suffix
     ));
-    let entity_update_mutation_filter_field_name =
-        Arc::new(context.entity_update_mutation.filter_field.clone());
     let entity_update_mutation_data_field_name =
         Arc::new(context.entity_update_mutation.data_field.clone());
-    let entity_query_field_name = Arc::new(entity_name);
-    let entity_query_filter_field_name = Arc::new(context.entity_query_field.filters.clone());
+
     Box::new(move |context: &ResolverContext| -> GuardAction {
         match context.ctx.data::<AuthUserInfo>() {
             Ok(user_info) => {
@@ -157,80 +137,26 @@ where
                                 &column_name,
                             )
                         }),
-                    field if field == entity_delete_mutation_field_name.as_str() => context
-                        .args
-                        .try_get(&entity_delete_mutation_filter_field_name)
-                        .and_then(|filter_value| {
-                            guard_filter_object_accessor_with_subscriber_id(
-                                filter_value,
-                                &column_name,
-                                subscriber_id,
-                            )
-                        })
-                        .map_err(|inner_error| {
-                            AuthError::from_graphql_subscribe_id_guard(
-                                inner_error,
-                                context,
-                                &entity_delete_mutation_filter_field_name,
-                                &column_name,
-                            )
-                        }),
-                    field if field == entity_update_mutation_field_name.as_str() => context
-                        .args
-                        .try_get(&entity_update_mutation_filter_field_name)
-                        .and_then(|filter_value| {
-                            guard_filter_object_accessor_with_subscriber_id(
-                                filter_value,
-                                &column_name,
-                                subscriber_id,
-                            )
-                        })
-                        .map_err(|inner_error| {
-                            AuthError::from_graphql_subscribe_id_guard(
-                                inner_error,
-                                context,
-                                &entity_update_mutation_filter_field_name,
-                                &column_name,
-                            )
-                        })
-                        .and_then(|_| {
-                            match context.args.get(&entity_update_mutation_data_field_name) {
-                                Some(data_value) => {
-                                    guard_data_object_accessor_with_optional_subscriber_id(
-                                        data_value,
+                    field if field == entity_update_mutation_field_name.as_str() => {
+                        match context.args.get(&entity_update_mutation_data_field_name) {
+                            Some(data_value) => {
+                                guard_data_object_accessor_with_optional_subscriber_id(
+                                    data_value,
+                                    &column_name,
+                                    subscriber_id,
+                                )
+                                .map_err(|inner_error| {
+                                    AuthError::from_graphql_subscribe_id_guard(
+                                        inner_error,
+                                        context,
+                                        &entity_update_mutation_data_field_name,
                                         &column_name,
-                                        subscriber_id,
                                     )
-                                    .map_err(|inner_error| {
-                                        AuthError::from_graphql_subscribe_id_guard(
-                                            inner_error,
-                                            context,
-                                            &entity_update_mutation_data_field_name,
-                                            &column_name,
-                                        )
-                                    })
-                                }
-                                None => Ok(()),
+                                })
                             }
-                        }),
-                    field if field == entity_query_field_name.as_str() => context
-                        .args
-                        .try_get(&entity_query_filter_field_name)
-                        .and_then(|filter_value| {
-                            guard_filter_object_accessor_with_subscriber_id(
-                                filter_value,
-                                &column_name,
-                                subscriber_id,
-                            )
-                        })
-                        .map_err(|inner_error| {
-                            AuthError::from_graphql_subscribe_id_guard(
-                                inner_error,
-                                context,
-                                &entity_query_filter_field_name,
-                                &column_name,
-                            )
-                        }),
+                            None => Ok(()),
+                        }
+                    }
                     field => Err(AuthError::from_graphql_subscribe_id_guard(
                         async_graphql::Error::new("unsupport graphql field"),
                         context,

apps/recorder/src/graphql/mod.rs

@@ -4,6 +4,7 @@ pub mod guard;
 pub mod schema_root;
 pub mod service;
 pub mod subscriptions;
+pub mod transformer;
 pub mod util;
 
 pub use config::GraphQLConfig;

apps/recorder/src/graphql/schema_root.rs

@@ -3,13 +3,16 @@ use once_cell::sync::OnceCell;
 use sea_orm::{DatabaseConnection, EntityTrait, Iterable};
 use seaography::{Builder, BuilderContext, FilterType, FilterTypesMapHelper};
 
-use super::{
-    filter::{SUBSCRIBER_ID_FILTER_INFO, subscriber_id_condition_function},
+use super::transformer::filter_condition_transformer;
+use crate::graphql::{
+    filter::{
+        SUBSCRIBER_ID_FILTER_INFO, init_custom_filter_info, subscriber_id_condition_function,
+    },
+    guard::{guard_entity_with_subscriber_id, guard_field_with_subscriber_id},
     util::{get_entity_column_key, get_entity_key},
 };
-use crate::graphql::{filter::init_custom_filter_info, guard::guard_entity_with_subscriber_id};
 
-static CONTEXT: OnceCell<BuilderContext> = OnceCell::new();
+pub static CONTEXT: OnceCell<BuilderContext> = OnceCell::new();
 
 fn restrict_filter_input_for_entity<T>(
     context: &mut BuilderContext,
@@ -31,9 +34,13 @@ where
     let entity_key = get_entity_key::<T>(context);
     let entity_column_key = get_entity_column_key::<T>(context, column);
     context.guards.entity_guards.insert(
-        entity_key,
+        entity_key.clone(),
         guard_entity_with_subscriber_id::<T>(context, column),
     );
+    context.guards.field_guards.insert(
+        entity_column_key.clone(),
+        guard_field_with_subscriber_id::<T>(context, column),
+    );
     context.filter_types.overwrites.insert(
         entity_column_key.clone(),
         Some(FilterType::Custom(
@@ -44,6 +51,10 @@ where
         entity_column_key,
         subscriber_id_condition_function::<T>(context, column),
     );
+    context.transformers.filter_conditions_transformers.insert(
+        entity_key,
+        filter_condition_transformer::<T>(context, column),
+    );
 }
 
 pub fn schema(
@@ -153,7 +164,6 @@ pub fn schema(
     };
     schema
         .data(database)
-        // .extension(GraphqlAuthExtension)
         .finish()
         .inspect_err(|e| tracing::error!(e = ?e))
 }

apps/recorder/src/graphql/transformer.rs

@@ -0,0 +1,27 @@
+use async_graphql::dynamic::ResolverContext;
+use sea_orm::{ColumnTrait, Condition, EntityTrait};
+use seaography::{BuilderContext, FnFilterConditionsTransformer};
+
+use crate::auth::AuthUserInfo;
+
+pub fn filter_condition_transformer<T>(
+    _context: &BuilderContext,
+    column: &T::Column,
+) -> FnFilterConditionsTransformer
+where
+    T: EntityTrait,
+    <T as EntityTrait>::Model: Sync,
+{
+    let column = *column;
+    Box::new(
+        move |context: &ResolverContext, condition: Condition| -> Condition {
+            match context.ctx.data::<AuthUserInfo>() {
+                Ok(user_info) => {
+                    let subscriber_id = user_info.subscriber_auth.subscriber_id;
+                    condition.add(column.eq(subscriber_id))
+                }
+                Err(err) => unreachable!("auth user info must be guarded: {:?}", err),
+            }
+        },
+    )
+}

apps/webui/.env

@@ -5,7 +5,7 @@ AUTH_TYPE = "basic" # or oidc
 BASIC_USER = "konobangu"
 BASIC_PASSWORD = "konobangu"
 # OIDC_ISSUER="https://auth.logto.io/oidc"
-# OIDC_API_AUDIENCE = "https://konobangu.com/api"
+# OIDC_AUDIENCE = "https://konobangu.com/api"
 # OIDC_CLIENT_ID = "client_id"
 # OIDC_CLIENT_SECRET = "client_secret" # optional
 # OIDC_EXTRA_SCOPES = "read:konobangu write:konobangu"

apps/webui/src/auth/context.ts

@@ -42,7 +42,7 @@ export interface OidcAuthContext {
   type: typeof AuthMethodEnum.OIDC;
   oidcSecurityService: OidcSecurityService;
   isAuthenticated$: Observable<boolean>;
-  userData$: Observable<any>;
+  userData$: Observable<{}>;
   checkAuthResultEvent$: Observable<CheckAuthResultEventType>;
 }
 

apps/webui/src/routes/_app/subscriptions/create.tsx

@@ -1,5 +1,37 @@
+import { useAuth } from '@/auth/hooks';
+import { Button } from '@/components/ui/button';
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardFooter,
+  CardHeader,
+  CardTitle,
+} from '@/components/ui/card';
+import {
+  Form,
+  FormControl,
+  FormDescription,
+  FormField,
+  FormItem,
+  FormLabel,
+  FormMessage,
+} from '@/components/ui/form';
+import { Input } from '@/components/ui/input';
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select';
+import { Switch } from '@/components/ui/switch';
 import type { RouteStateDataOption } from '@/traits/router';
 import { createFileRoute } from '@tanstack/react-router';
+import { useNavigate } from '@tanstack/react-router';
+import { useState } from 'react';
+import { useForm } from 'react-hook-form';
+import { toast } from 'sonner';
 
 export const Route = createFileRoute('/_app/subscriptions/create')({
   component: SubscriptionCreateRouteComponent,
@@ -8,6 +40,198 @@ export const Route = createFileRoute('/_app/subscriptions/create')({
   } satisfies RouteStateDataOption,
 });
 
+type SubscriptionFormValues = {
+  displayName: string;
+  sourceUrl: string;
+  category: string;
+  enabled: boolean;
+};
+
 function SubscriptionCreateRouteComponent() {
-  return <div>Hello "/subscriptions/create"!</div>;
+  const { userData } = useAuth();
+  console.log(JSON.stringify(userData, null, 2));
+  const [isSubmitting, setIsSubmitting] = useState(false);
+  const navigate = useNavigate();
+  const form = useForm<SubscriptionFormValues>({
+    defaultValues: {
+      displayName: '',
+      sourceUrl: '',
+      category: 'Mikan',
+      enabled: true,
+    },
+  });
+
+  const onSubmit = async (data: SubscriptionFormValues) => {
+    try {
+      setIsSubmitting(true);
+      const requestData = {
+        query: `
+          mutation CreateSubscription($input: SubscriptionsInsertInput!) {
+            subscriptionsCreateOne(data: $input) {
+              id
+              displayName
+              sourceUrl
+              enabled
+              category
+            }
+          }
+        `,
+        variables: {
+          input: {
+            category: data.category,
+            displayName: data.displayName,
+            sourceUrl: data.sourceUrl,
+            enabled: data.enabled,
+          },
+        },
+      };
+
+      const response = await fetch('/api/graphql', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(requestData),
+      });
+
+      const responseData = await response.json();
+      if (responseData.errors) {
+        throw new Error(
+          responseData.errors[0]?.message || 'Failed to create subscription'
+        );
+      }
+
+      toast.success('Subscription created successfully');
+      navigate({ to: '/subscriptions/manage' });
+    } catch (error) {
+      console.error('Failed to create subscription:', error);
+      toast.error(
+        `Subscription creation failed: ${
+          error instanceof Error ? error.message : 'Unknown error'
+        }`
+      );
+    } finally {
+      setIsSubmitting(false);
+    }
+  };
+
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle>Create Anime Subscription</CardTitle>
+        <CardDescription>Add a new anime subscription source</CardDescription>
+      </CardHeader>
+      <CardContent>
+        <Form {...form}>
+          <form onSubmit={form.handleSubmit(onSubmit)} className="space-y-6">
+            <FormField
+              control={form.control}
+              name="category"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Source Type</FormLabel>
+                  <Select
+                    disabled
+                    value={field.value}
+                    onValueChange={field.onChange}
+                    defaultValue="Mikan"
+                  >
+                    <FormControl>
+                      <SelectTrigger>
+                        <SelectValue placeholder="Select source type" />
+                      </SelectTrigger>
+                    </FormControl>
+                    <SelectContent>
+                      <SelectItem value="Mikan">Mikan</SelectItem>
+                    </SelectContent>
+                  </Select>
+                  <FormDescription>
+                    Currently only Mikan source is supported
+                  </FormDescription>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+
+            <FormField
+              control={form.control}
+              name="displayName"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Display Name</FormLabel>
+                  <FormControl>
+                    <Input
+                      placeholder="Enter subscription display name"
+                      {...field}
+                    />
+                  </FormControl>
+                  <FormDescription>
+                    Set an easily recognizable name for this subscription
+                  </FormDescription>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+
+            <FormField
+              control={form.control}
+              name="sourceUrl"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Source URL</FormLabel>
+                  <FormControl>
+                    <Input
+                      placeholder="Enter subscription source URL"
+                      {...field}
+                    />
+                  </FormControl>
+                  <FormDescription>
+                    Copy the RSS subscription link from the source website, e.g.
+                    https://mikanani.me/RSS/Bangumi?bangumiId=3141&subgroupid=370
+                  </FormDescription>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+
+            <FormField
+              control={form.control}
+              name="enabled"
+              render={({ field }) => (
+                <FormItem className="flex flex-row items-center justify-between rounded-lg border p-4">
+                  <div className="space-y-0.5">
+                    <FormLabel className="text-base">
+                      Enable Subscription
+                    </FormLabel>
+                    <FormDescription>
+                      Enable this subscription immediately after creation
+                    </FormDescription>
+                  </div>
+                  <FormControl>
+                    <Switch
+                      checked={field.value}
+                      onCheckedChange={field.onChange}
+                    />
+                  </FormControl>
+                </FormItem>
+              )}
+            />
+          </form>
+        </Form>
+      </CardContent>
+      <CardFooter className="flex justify-between">
+        <Button
+          variant="outline"
+          onClick={() => navigate({ to: '/subscriptions/manage' })}
+        >
+          Cancel
+        </Button>
+        <Button
+          type="submit"
+          onClick={form.handleSubmit(onSubmit)}
+          disabled={isSubmitting}
+        >
+          {isSubmitting ? 'Creating...' : 'Create Subscription'}
+        </Button>
+      </CardFooter>
+    </Card>
+  );
 }