@90soft/parse-server-kit 2.8.2 → 2.10.1

package/dist/utils/roleCache.js

@@ -0,0 +1,112 @@
+"use strict";
+/**
+ * Role membership, remembered for a while.
+ *
+ * `@CloudFunction({requireRoles})` asks the database who a user is on every
+ * single call, and so does every `getUserRoles()`. That is a full round-trip —
+ * milliseconds, not microseconds — to answer a question whose answer almost
+ * never changes.
+ *
+ * **Off by default, and deliberately so.** Caching membership means a revoked
+ * role keeps working until the entry expires. That is a security trade, and it
+ * belongs to whoever runs the deployment, not to this library. Nothing here
+ * takes effect until `configureRoleCache()` is called.
+ *
+ * When it is on, `invalidateRoles(userId)` is the tool that keeps the window
+ * from mattering: call it wherever you grant or revoke, and the TTL becomes a
+ * backstop for changes made outside your code rather than the primary control.
+ *
+ * There is no timer. Entries expire when read and the map is capped on write,
+ * so importing this module costs nothing and holds nothing open.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configureRoleCache = configureRoleCache;
+exports.roleCacheEnabled = roleCacheEnabled;
+exports.invalidateRoles = invalidateRoles;
+exports.roleCacheStats = roleCacheStats;
+exports.readCachedRoles = readCachedRoles;
+exports.writeCachedRoles = writeCachedRoles;
+const DEFAULT_MAX_USERS = 10000;
+let options = null;
+const cache = new Map();
+/**
+ * Turn the cache on, change its settings, or turn it off with `false`.
+ *
+ * Switching off clears whatever was held, so a deployment can disable it and be
+ * certain nothing stale survives.
+ */
+function configureRoleCache(config) {
+    if (config === false) {
+        options = null;
+        cache.clear();
+        return;
+    }
+    if (!Number.isFinite(config.ttlMs) || config.ttlMs <= 0) {
+        throw new Error(`configureRoleCache: ttlMs must be a positive number, got ${config.ttlMs}. ` +
+            'Pass `false` to disable the cache.');
+    }
+    options = {
+        ttlMs: config.ttlMs,
+        maxUsers: config.maxUsers ?? DEFAULT_MAX_USERS,
+    };
+}
+function roleCacheEnabled() {
+    return options !== null;
+}
+/**
+ * Forget a user's roles, or everyone's.
+ *
+ * Call this wherever a role is granted or revoked. Safe to call when the cache
+ * is off — it simply has nothing to do.
+ */
+function invalidateRoles(userId) {
+    if (userId === undefined)
+        cache.clear();
+    else
+        cache.delete(userId);
+}
+/** For tests and for reporting. */
+function roleCacheStats() {
+    return {
+        enabled: options !== null,
+        size: cache.size,
+        ttlMs: options?.ttlMs ?? null,
+    };
+}
+/**
+ * The cached roles for this user, or nothing if there is no live entry.
+ *
+ * `ttlOverrideMs` of 0 means "do not use the cache for this call" — how a
+ * single cloud function opts out of a global policy.
+ */
+function readCachedRoles(userId, ttlOverrideMs) {
+    if (!options || ttlOverrideMs === 0)
+        return undefined;
+    const entry = cache.get(userId);
+    if (!entry)
+        return undefined;
+    if (Date.now() >= entry.expiresAt) {
+        cache.delete(userId);
+        return undefined;
+    }
+    // A copy, not the stored array. Handing out the internal one means a caller
+    // that sorts or filters it in place silently rewrites what every later
+    // permission check for this user sees.
+    return entry.roles.slice();
+}
+/** Remember this user's roles. A no-op while the cache is off. */
+function writeCachedRoles(userId, roles, ttlOverrideMs) {
+    if (!options || ttlOverrideMs === 0)
+        return;
+    // Map preserves insertion order, so the first key is the oldest write.
+    if (cache.size >= options.maxUsers && !cache.has(userId)) {
+        const oldest = cache.keys().next();
+        if (!oldest.done)
+            cache.delete(oldest.value);
+    }
+    cache.set(userId, {
+        roles,
+        expiresAt: Date.now() + (ttlOverrideMs ?? options.ttlMs),
+    });
+}
+//# sourceMappingURL=roleCache.js.map

package/dist/utils/roleCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roleCache.js","sourceRoot":"","sources":["../../src/utils/roleCache.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;AA4BH,gDAkBC;AAED,4CAEC;AAQD,0CAGC;AAGD,wCAMC;AAQD,0CAiBC;AAGD,4CAiBC;AAlGD,MAAM,iBAAiB,GAAG,KAAM,CAAC;AAEjC,IAAI,OAAO,GAAsC,IAAI,CAAC;AACtD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;AAE5C;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,MAAgC;IACjE,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO;IACT,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,4DAA4D,MAAM,CAAC,KAAK,IAAI;YAC1E,oCAAoC,CACvC,CAAC;IACJ,CAAC;IAED,OAAO,GAAG;QACR,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,iBAAiB;KAC/C,CAAC;AACJ,CAAC;AAED,SAAgB,gBAAgB;IAC9B,OAAO,OAAO,KAAK,IAAI,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,MAAe;IAC7C,IAAI,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,KAAK,EAAE,CAAC;;QACnC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,mCAAmC;AACnC,SAAgB,cAAc;IAC5B,OAAO;QACL,OAAO,EAAE,OAAO,KAAK,IAAI;QACzB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,eAAe,CAC7B,MAAc,EACd,aAAsB;IAEtB,IAAI,CAAC,OAAO,IAAI,aAAa,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEtD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE7B,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAClC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,4EAA4E;IAC5E,uEAAuE;IACvE,uCAAuC;IACvC,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,kEAAkE;AAClE,SAAgB,gBAAgB,CAC9B,MAAc,EACd,KAAe,EACf,aAAsB;IAEtB,IAAI,CAAC,OAAO,IAAI,aAAa,KAAK,CAAC;QAAE,OAAO;IAE5C,uEAAuE;IACvE,IAAI,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,IAAI;YAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;QAChB,KAAK;QACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,KAAK,CAAC;KACzD,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@90soft/parse-server-kit",
-  "version": "2.8.2",
+  "version": "2.10.1",
   "description": "Complete decorator-driven development kit for Parse Server — models, cloud functions, triggers, cron, routing, ACL, Swagger, and more.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [
     "dist",
-    "CLAUDE.md"
+    "CLAUDE.md",
+    "CHANGELOG.md"
   ],
   "scripts": {
     "build": "tsc",