auth-valid-restrict-keys

Rule Details

To define authorizations on a fine-grained level, the @restrict annotation allows you to add all kinds of restrictions based on static user roles, the request operation, and instance filters. The building block of such a restriction is a single privilege. This rule checks that the privileges defined in @restrict have properly spelled to, grant, and where keys.

Examples

✅   Correct example

In the following example, the @restrict annotation on CatalogService.ListOfBooks has correctly spelled to, grant, and where keys in the defined privilege:

srv/cat-service.cds

using { sap.capire.bookshop as my } from '../db/schema';

service CatalogService {
  @(restrict: [{ grant: 'READ', to: 'Viewer', where: 'CreatedBy = $user' }])
  @readonly entity ListOfBooks as projection on Books excluding { descr };

  @readonly entity Books as projection on my.Books { *,
    author.name as author
  } excluding { createdBy, modifiedBy };
}

Open In Playground

❌   Incorrect example

This example shows the @restrict annotation on CatalogService.ListOfBooks with typos in the grant key (grants instead of grant), the to key (too instead of to), and the where key (were instead of where) and the rule will report them as a warning:

srv/cat-service.cds

using { sap.capire.bookshop as my } from '../db/schema';

service CatalogService {
    @(restrict: [{ grants: 'READ', too: 'Viewer', were: 'CreatedBy = $user' }])
  // Misspelled key 'grants'. Did you mean 'grant'?
  // Misspelled key 'too'. Did you mean 'to'?
  // Misspelled key 'were'. Did you mean 'where'?
  @readonly entity ListOfBooks as projection on Books excluding { descr }; 

  @readonly entity Books as projection on my.Books { *,
    author.name as author
  } excluding { createdBy, modifiedBy };
}

Open In Playground

Version

This rule was introduced in @sap/eslint-plugin-cds 2.4.1.