feat(schema-compiler): Support shorthand for userAttributes properties in models (#9921)

KSDaemon · igorlukanin · commit ffc852ea89b4 · 2025-10-29T14:35:35.000+01:00
* more types (SymbolResolver)

* add userAttributes to CONTEXT_SYMBOLS

* add tests for CubePropContextTranspiler with userAttributes

* Rewrite shorthand for userAttributes to full path during transpilation

* remove unneded

* reduce scope to ACL only
diff --git a/packages/cubejs-schema-compiler/src/compiler/transpilers/CubePropContextTranspiler.ts b/packages/cubejs-schema-compiler/src/compiler/transpilers/CubePropContextTranspiler.ts
@@ -3,6 +3,7 @@ import R from 'ramda';
 
 import type { NodePath } from '@babel/traverse';
 import {
+  SymbolResolver,
   TranspilerCubeResolver,
   TranspilerInterface,
   TranspilerSymbolResolver,
@@ -59,7 +60,7 @@ export class CubePropContextTranspiler implements TranspilerInterface {
                 args[0].node.type === 'TemplateLiteral' &&
                 args[0].node.quasis.length &&
                 args[0].node.quasis[0].value.cooked;
-              args[args.length - 1].traverse(this.sqlAndReferencesFieldVisitor(cubeName));
+              args[args.length - 1].traverse(this.sqlAndReferencesFieldVisitor(cubeName as string));
               args[args.length - 1].traverse(
                 this.knownIdentifiersInjectVisitor('extends', name => this.cubeDictionary.resolveCube(name))
               );
@@ -72,15 +73,16 @@ export class CubePropContextTranspiler implements TranspilerInterface {
     };
   }
 
-  protected transformObjectProperty(path: NodePath<t.ObjectProperty>, resolveSymbol: (name: string) => void) {
+  protected transformObjectProperty(path: NodePath<t.ObjectProperty>, resolveSymbol: SymbolResolver) {
     CubePropContextTranspiler.replaceValueWithArrowFunction(resolveSymbol, path.get('value'));
   }
 
-  public static replaceValueWithArrowFunction(resolveSymbol: (name: string) => any, value: NodePath<any>) {
-    const knownIds = CubePropContextTranspiler.collectKnownIdentifiers(
+  public static replaceValueWithArrowFunction(resolveSymbol: SymbolResolver, value: NodePath<any>) {
+    const knownIds = CubePropContextTranspiler.collectKnownIdentifiersAndTransform(
       resolveSymbol,
       value,
     );
+
     value.replaceWith(
       t.arrowFunctionExpression(
         knownIds.map(i => t.identifier(i)),
@@ -91,22 +93,22 @@ export class CubePropContextTranspiler implements TranspilerInterface {
     );
   }
 
-  protected sqlAndReferencesFieldVisitor(cubeName): TraverseObject {
+  protected sqlAndReferencesFieldVisitor(cubeName: string | null | undefined): TraverseObject {
     const resolveSymbol = n => this.viewCompiler.resolveSymbol(cubeName, n) ||
       this.cubeSymbols.resolveSymbol(cubeName, n) ||
       this.cubeSymbols.isCurrentCube(n);
 
     return {
       ObjectProperty: (path) => {
         if (path.node.key.type === 'Identifier' && path.node.key.name === 'joins' && t.isObjectExpression(path.node.value)) {
-          const fullPath = this.fullPath(path);
+          const fullPath = CubePropContextTranspiler.fullPath(path);
           if (fullPath === 'joins') {
             this.convertJoinsObjectToArray(path);
           }
         }
 
         if (path.node.key.type === 'Identifier' && transpiledFields.has(path.node.key.name)) {
-          const fullPath = this.fullPath(path);
+          const fullPath = CubePropContextTranspiler.fullPath(path);
           // eslint-disable-next-line no-restricted-syntax
           for (const p of transpiledFieldsPatterns) {
             if (fullPath.match(p)) {
@@ -152,7 +154,7 @@ export class CubePropContextTranspiler implements TranspilerInterface {
     valuePath.replaceWith(t.arrayExpression(elements));
   }
 
-  protected fullPath(path: NodePath<t.ObjectProperty>): string {
+  protected static fullPath(path: NodePath): string {
     // @ts-ignore
     let fp = path?.node?.key?.name || '';
     let pp: NodePath<t.Node> | null | undefined = path?.parentPath;
@@ -171,7 +173,7 @@ export class CubePropContextTranspiler implements TranspilerInterface {
     return fp;
   }
 
-  protected knownIdentifiersInjectVisitor(field: RegExp | string, resolveSymbol: (name: string) => void): TraverseObject {
+  protected knownIdentifiersInjectVisitor(field: RegExp | string, resolveSymbol: SymbolResolver): TraverseObject {
     return {
       ObjectProperty: (path) => {
         if (path.node.key.type === 'Identifier' && path.node.key.name.match(field)) {
@@ -181,30 +183,53 @@ export class CubePropContextTranspiler implements TranspilerInterface {
     };
   }
 
-  protected static collectKnownIdentifiers(resolveSymbol, path: NodePath) {
-    const identifiers = [];
+  protected static collectKnownIdentifiersAndTransform(resolveSymbol: SymbolResolver, path: NodePath): string[] {
+    const identifiers: string[] = [];
 
     if (path.node.type === 'Identifier') {
-      CubePropContextTranspiler.matchAndPushIdentifier(path, resolveSymbol, identifiers);
+      CubePropContextTranspiler.matchAndTransformIdentifier(path, resolveSymbol, identifiers);
     }
 
     path.traverse({
       Identifier: (p) => {
-        CubePropContextTranspiler.matchAndPushIdentifier(p, resolveSymbol, identifiers);
+        CubePropContextTranspiler.matchAndTransformIdentifier(p, resolveSymbol, identifiers);
+      },
+      MemberExpression: (p) => {
+        CubePropContextTranspiler.transformUserAttributesMemberExpression(p);
       }
     });
 
     return R.uniq(identifiers);
   }
 
-  protected static matchAndPushIdentifier(path, resolveSymbol, identifiers) {
+  protected static matchAndTransformIdentifier(path, resolveSymbol: SymbolResolver, identifiers: string[]) {
     if (
       (!path.parent ||
         (path.parent.type !== 'MemberExpression' || path.parent.type === 'MemberExpression' && path.key !== 'property')
       ) &&
       resolveSymbol(path.node.name)
     ) {
-      identifiers.push(path.node.name);
+      // Special handling for userAttributes - replace in parameter list with securityContext
+      const fullPath = this.fullPath(path);
+      if (path.node.name === 'userAttributes' && (fullPath.startsWith('accessPolicy') || fullPath.startsWith('access_policy'))) {
+        identifiers.push('securityContext');
+      } else {
+        identifiers.push(path.node.name);
+      }
+    }
+  }
+
+  protected static transformUserAttributesMemberExpression(path: NodePath<t.MemberExpression>) {
+    // Check if this is userAttributes.someProperty (object should be identifier named 'userAttributes')
+    const fullPath = this.fullPath(path);
+    if (t.isIdentifier(path.node.object, { name: 'userAttributes' }) && (fullPath.startsWith('accessPolicy') || fullPath.startsWith('access_policy'))) {
+      // Replace userAttributes with securityContext.cubeCloud.userAttributes
+      const securityContext = t.identifier('securityContext');
+      const cubeCloud = t.memberExpression(securityContext, t.identifier('cubeCloud'));
+      const userAttributes = t.memberExpression(cubeCloud, t.identifier('userAttributes'));
+      const newMemberExpression = t.memberExpression(userAttributes, path.node.property, path.node.computed);
+
+      path.replaceWith(newMemberExpression);
     }
   }
 }
diff --git a/packages/cubejs-schema-compiler/src/compiler/transpilers/transpiler.interface.ts b/packages/cubejs-schema-compiler/src/compiler/transpilers/transpiler.interface.ts
@@ -15,3 +15,5 @@ export interface TranspilerSymbolResolver {
 export interface TranspilerCubeResolver {
   resolveCube(name): boolean;
 }
+
+export type SymbolResolver = (name: string) => any;
diff --git a/packages/cubejs-schema-compiler/test/unit/transpilers.test.ts b/packages/cubejs-schema-compiler/test/unit/transpilers.test.ts
@@ -5,6 +5,7 @@ import babelTraverse from '@babel/traverse';
 import { prepareJsCompiler } from './PrepareCompiler';
 import { ImportExportTranspiler } from '../../src/compiler/transpilers';
 import { ErrorReporter } from '../../src/compiler/ErrorReporter';
+import { PostgresQuery } from '../../src';
 
 describe('Transpilers', () => {
   it('CubeCheckDuplicatePropTranspiler', async () => {
@@ -50,6 +51,72 @@ describe('Transpilers', () => {
     await compiler.compile();
   });
 
+  it('CubePropContextTranspiler with full path to userAttributes should work normally', async () => {
+    const { cubeEvaluator, compiler } = prepareJsCompiler(`
+        cube(\`Test\`, {
+          sql: 'SELECT * FROM users',
+          dimensions: {
+            userId: {
+              sql: \`userId\`,
+              type: 'string'
+            }
+          },
+          accessPolicy: [
+            {
+              role: \`*\`,
+              rowLevel: {
+                filters: [
+                  {
+                    member: \`userId\`,
+                    operator: \`equals\`,
+                    values: [ securityContext.cubeCloud.userAttributes.userId ]
+                  }
+                ]
+              }
+            }
+          ]
+        })
+    `);
+
+    await compiler.compile();
+
+    const transpiledValues = cubeEvaluator.cubeFromPath('Test').accessPolicy?.[0].rowLevel?.filters?.[0].values;
+    expect(transpiledValues.toString()).toMatch('securityContext.cubeCloud.userAttributes.userId');
+  });
+
+  it('CubePropContextTranspiler with shorthand userAttributes should work normally', async () => {
+    const { cubeEvaluator, compiler } = prepareJsCompiler(`
+        cube(\`Test\`, {
+          sql: 'SELECT * FROM users',
+          dimensions: {
+            userId: {
+              sql: \`userId\`,
+              type: 'string'
+            }
+          },
+          accessPolicy: [
+            {
+              role: \`*\`,
+              rowLevel: {
+                filters: [
+                  {
+                    member: \`userId\`,
+                    operator: \`equals\`,
+                    values: [ userAttributes.userId ]
+                  }
+                ]
+              }
+            }
+          ]
+        })
+    `);
+
+    await compiler.compile();
+
+    const transpiledValues = cubeEvaluator.cubeFromPath('Test').accessPolicy?.[0].rowLevel?.filters?.[0].values;
+    expect(transpiledValues.toString()).toMatch('securityContext.cubeCloud.userAttributes.userId');
+  });
+
   it('ImportExportTranspiler', async () => {
     const ieTranspiler = new ImportExportTranspiler();
     const errorsReport = new ErrorReporter();

Original file line number	Diff line number	Diff line change
`@@ -15,3 +15,5 @@ export interface TranspilerSymbolResolver {`
`15`	`15`	`export interface TranspilerCubeResolver {`
`16`	`16`	`resolveCube(name): boolean;`
`17`	`17`	`}`
	`18`	`+`
	`19`	`+export type SymbolResolver = (name: string) => any;`