feat(server): sql access checks (#6635)

server/src/infra/sql-generator/index.ts

@@ -98,8 +98,25 @@ class SqlGenerator {
 
     const data: string[] = [`-- NOTE: This file is auto generated by ./sql-generator`];
     const instance = this.app.get<Repository>(Repository);
-    const properties = Object.getOwnPropertyNames(Repository.prototype) as Array<keyof typeof Repository>;
-    for (const key of properties) {
+
+    // normal repositories
+    data.push(...(await this.runTargets(instance, `${Repository.name}`)));
+
+    // nested repositories
+    if (Repository.name === AccessRepository.name) {
+      for (const key of Object.keys(instance)) {
+        const subInstance = (instance as any)[key];
+        data.push(...(await this.runTargets(subInstance, `${Repository.name}.${key}`)));
+      }
+    }
+
+    this.results[Repository.name] = data;
+  }
+
+  private async runTargets(instance: any, label: string) {
+    const data: string[] = [];
+
+    for (const key of this.getPropertyNames(instance)) {
       const target = instance[key];
       if (!(target instanceof Function)) {
         continue;
@@ -116,7 +133,7 @@ class SqlGenerator {
       }
 
       for (const { name, params } of queries) {
-        let queryLabel = `${Repository.name}.${key}`;
+        let queryLabel = `${label}.${key}`;
         if (name) {
           queryLabel += ` (${name})`;
         }
@@ -135,7 +152,7 @@ class SqlGenerator {
       }
     }
 
-    this.results[Repository.name] = data;
+    return data;
   }
 
   private async write() {
@@ -156,6 +173,10 @@ class SqlGenerator {
       await this.app.close();
     }
   }
+
+  private getPropertyNames(instance: any): string[] {
+    return Object.getOwnPropertyNames(Object.getPrototypeOf(instance)) as any[];
+  }
 }
 
 new SqlGenerator({ targetDir: './src/infra/sql' })