feat(rbac): added glob support in permission and revealed settings

frontend/src/hooks/api/roles/queries.tsx

@@ -1,6 +1,8 @@
-import { createMongoAbility, MongoAbility, RawRuleOf } from "@casl/ability";
+import { buildMongoQueryMatcher, createMongoAbility, MongoAbility, RawRuleOf } from "@casl/ability";
 import { PackRule, unpackRules } from "@casl/ability/extra";
 import { useQuery } from "@tanstack/react-query";
+import { FieldCondition, FieldInstruction, JsInterpreter } from "@ucast/mongo2js";
+import picomatch from "picomatch";
 
 import { apiRequest } from "@app/config/request";
 import { OrgPermissionSet } from "@app/context/OrgPermissionContext/types";
@@ -13,6 +15,29 @@ import {
   TRole
 } from "./types";
 
+const $glob: FieldInstruction<string> = {
+  type: "field",
+  validate(instruction, value) {
+    if (typeof value !== "string") {
+      throw new Error(`"${instruction.name}" expects value to be a string`);
+    }
+  }
+};
+
+const glob: JsInterpreter<FieldCondition<string>> = (node, object, context) => {
+  const secretPath = context.get(object, node.field);
+  const permissionSecretGlobPath = node.value;
+  if (!secretPath) return false;
+  // console.log(
+  //   secretPath,
+  //   picomatch.isMatch(secretPath, permissionSecretGlobPath, { strictSlashes: false }),
+  //   permissionSecretGlobPath
+  // );
+  return picomatch.isMatch(secretPath, permissionSecretGlobPath, { strictSlashes: false });
+};
+
+const conditionsMatcher = buildMongoQueryMatcher({ $glob }, { glob });
+
 export const roleQueryKeys = {
   getRoles: ({ orgId, workspaceId }: TGetRolesDTO) => ["roles", { orgId, workspaceId }] as const,
   getUserOrgPermissions: ({ orgId }: TGetUserOrgPermissionsDTO) =>
@@ -57,7 +82,7 @@ export const useGetUserOrgPermissions = ({ orgId }: TGetUserOrgPermissionsDTO) =
     enabled: Boolean(orgId),
     select: (data) => {
       const rule = unpackRules<RawRuleOf<MongoAbility<OrgPermissionSet>>>(data);
-      const ability = createMongoAbility<OrgPermissionSet>(rule);
+      const ability = createMongoAbility<OrgPermissionSet>(rule, { conditionsMatcher });
       return ability;
     }
   });