@aeriajs/builtins 0.0.228 → 0.0.229

package/dist/collections/user/index.d.ts

@@ -243,7 +243,17 @@ export declare const user: Omit<Collection<never>, "functions" | "description" |
         } & {
             httpStatus: import("@aeriajs/types").HTTPStatus.Forbidden;
         }>>;
-        readonly insert: (payload: NoInfer<import("@aeriajs/types").InsertPayload<import("@aeriajs/types").SchemaWithId<import("@aeriajs/types").Description>>>, context: Omit<Context, "token">) => Promise<import("@aeriajs/types").InsertReturnType<import("@aeriajs/types").SchemaWithId<import("@aeriajs/types").Description>>>;
+        readonly insert: (payload: NoInfer<import("@aeriajs/types").InsertPayload<import("@aeriajs/types").SchemaWithId<import("@aeriajs/types").Description>>>, context: Omit<Context, "token">) => Promise<import("@aeriajs/types").Result.Error<{
+            readonly code: import("@aeriajs/types").ACError.AuthorizationError;
+            readonly message: "user is not allowed to edit other users roles";
+        } & {
+            httpStatus: import("@aeriajs/types").HTTPStatus.Forbidden;
+        }> | import("@aeriajs/types").Result.Error<{
+            readonly code: import("@aeriajs/types").ACError.AuthorizationError;
+            readonly message: "tried to set unallowed roles";
+        } & {
+            httpStatus: import("@aeriajs/types").HTTPStatus.Forbidden;
+        }> | import("@aeriajs/types").InsertReturnType<import("@aeriajs/types").SchemaWithId<import("@aeriajs/types").Description>>>;
         readonly editProfile: (payload: Partial<import("@aeriajs/types").PackReferences<import("@aeriajs/types").SchemaWithId<{
             readonly $id: "user";
             readonly icon: "users";

package/dist/collections/user/insert.d.ts

@@ -1,2 +1,13 @@
 import type { Context, SchemaWithId, InsertPayload, Description } from '@aeriajs/types';
-export declare const insert: <TDescription extends Description, TInsertPayload extends InsertPayload<SchemaWithId<TDescription>>>(payload: NoInfer<TInsertPayload>, context: Context<TDescription>) => Promise<import("@aeriajs/types").InsertReturnType<SchemaWithId<TDescription>>>;
+import { HTTPStatus, ACError } from '@aeriajs/types';
+export declare const insert: <TDescription extends Description, TInsertPayload extends InsertPayload<SchemaWithId<TDescription>>>(payload: NoInfer<TInsertPayload>, context: Context<TDescription>) => Promise<import("@aeriajs/types").Result.Error<{
+    readonly code: ACError.AuthorizationError;
+    readonly message: "user is not allowed to edit other users roles";
+} & {
+    httpStatus: HTTPStatus.Forbidden;
+}> | import("@aeriajs/types").Result.Error<{
+    readonly code: ACError.AuthorizationError;
+    readonly message: "tried to set unallowed roles";
+} & {
+    httpStatus: HTTPStatus.Forbidden;
+}> | import("@aeriajs/types").InsertReturnType<SchemaWithId<TDescription>>>;

package/dist/collections/user/insert.js

@@ -1,9 +1,50 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.insert = void 0;
+const types_1 = require("@aeriajs/types");
+const common_1 = require("@aeriajs/common");
 const core_1 = require("@aeriajs/core");
 const bcrypt = require("bcrypt");
+const isRoleAllowed = (targetRole, context) => {
+    if (!context.config.security.rolesHierarchy || !context.token.authenticated) {
+        throw new Error;
+    }
+    for (const role of context.token.roles) {
+        if (role in context.config.security.rolesHierarchy) {
+            const hierarchy = context.config.security.rolesHierarchy[role];
+            if (!hierarchy) {
+                continue;
+            }
+            if (hierarchy === true || hierarchy.includes(targetRole)) {
+                return true;
+            }
+        }
+    }
+    return false;
+};
 const insert = async (payload, context) => {
+    if (!context.token.authenticated) {
+        throw new Error;
+    }
+    if ('roles' in payload.what) {
+        if (context.config.security.rolesHierarchy) {
+            if (!(0, common_1.arraysIntersect)(context.token.roles, Object.keys(context.config.security.rolesHierarchy))) {
+                return context.error(types_1.HTTPStatus.Forbidden, {
+                    code: types_1.ACError.AuthorizationError,
+                    message: 'user is not allowed to edit other users roles',
+                });
+            }
+            if (Array.isArray(payload.what.roles)) {
+                const allowed = payload.what.roles.every((role) => isRoleAllowed(role, context));
+                if (!allowed) {
+                    return context.error(types_1.HTTPStatus.Forbidden, {
+                        code: types_1.ACError.AuthorizationError,
+                        message: 'tried to set unallowed roles',
+                    });
+                }
+            }
+        }
+    }
     if ('password' in payload.what && typeof payload.what.password === 'string') {
         payload.what.password = await bcrypt.hash(payload.what.password, 10);
     }

package/dist/collections/user/insert.mjs

@@ -1,7 +1,48 @@
 "use strict";
+import { HTTPStatus, ACError } from "@aeriajs/types";
+import { arraysIntersect } from "@aeriajs/common";
 import { insert as originalInsert } from "@aeriajs/core";
 import * as bcrypt from "bcrypt";
+const isRoleAllowed = (targetRole, context) => {
+  if (!context.config.security.rolesHierarchy || !context.token.authenticated) {
+    throw new Error();
+  }
+  for (const role of context.token.roles) {
+    if (role in context.config.security.rolesHierarchy) {
+      const hierarchy = context.config.security.rolesHierarchy[role];
+      if (!hierarchy) {
+        continue;
+      }
+      if (hierarchy === true || hierarchy.includes(targetRole)) {
+        return true;
+      }
+    }
+  }
+  return false;
+};
 export const insert = async (payload, context) => {
+  if (!context.token.authenticated) {
+    throw new Error();
+  }
+  if ("roles" in payload.what) {
+    if (context.config.security.rolesHierarchy) {
+      if (!arraysIntersect(context.token.roles, Object.keys(context.config.security.rolesHierarchy))) {
+        return context.error(HTTPStatus.Forbidden, {
+          code: ACError.AuthorizationError,
+          message: "user is not allowed to edit other users roles"
+        });
+      }
+      if (Array.isArray(payload.what.roles)) {
+        const allowed = payload.what.roles.every((role) => isRoleAllowed(role, context));
+        if (!allowed) {
+          return context.error(HTTPStatus.Forbidden, {
+            code: ACError.AuthorizationError,
+            message: "tried to set unallowed roles"
+          });
+        }
+      }
+    }
+  }
   if ("password" in payload.what && typeof payload.what.password === "string") {
     payload.what.password = await bcrypt.hash(payload.what.password, 10);
   }

package/dist/functions/describe.d.ts

@@ -1,4 +1,4 @@
-import type { Description, RouteContext } from '@aeriajs/types';
+import type { Description, RouteContext, RolesHierarchy, UserRole } from '@aeriajs/types';
 import { Result, ACError, HTTPStatus } from '@aeriajs/types';
 import { authenticate } from '../collections/user/authenticate.js';
 declare const Payload: Partial<{} & Omit<Readonly<import("@aeriajs/types").FilterReadonlyProperties<{
@@ -56,9 +56,10 @@ export declare const describe: (contextOrPayload: RouteContext | typeof Payload)
     readonly error: undefined;
     readonly result: {
         descriptions: Record<string, Description>;
-        roles?: string[];
+        roles?: UserRole[];
         auth?: Awaited<ReturnType<typeof authenticate>> extends Result.Either<unknown, infer Right> ? Partial<Right> : never;
         router?: unknown;
+        rolesHierarchy?: RolesHierarchy;
     };
 }>;
 export {};

package/dist/functions/describe.js

@@ -33,7 +33,9 @@ const [Payload, validatePayload] = (0, validation_1.validator)({
     },
 });
 const describe = async (contextOrPayload) => {
-    const result = {};
+    const result = {
+        descriptions: {},
+    };
     let props;
     if ('request' in contextOrPayload) {
         const { error, result: validatedPayload } = validatePayload(contextOrPayload.request.payload);
@@ -72,7 +74,7 @@ const describe = async (contextOrPayload) => {
         const collection = typeof candidate === 'function'
             ? candidate()
             : candidate;
-        if (!(0, core_1.isValidCollection)(collection)) {
+        if (!(0, common_1.isValidCollection)(collection)) {
             throw new Error(`The "${collectionName}" symbol exported from the entrypoint doesn't seem like a valid collection. Make sure only collections are exported from the "import('.').collections".`);
         }
         const { description: rawDescription } = collection;
@@ -89,6 +91,9 @@ const describe = async (contextOrPayload) => {
             ? userRolesProperty.items.enum
             : [];
         result.roles = Array.from(new Set(userRoles.concat(await (0, entrypoint_1.getAvailableRoles)())));
+        if ('config' in contextOrPayload) {
+            result.rolesHierarchy = contextOrPayload.config.security.rolesHierarchy;
+        }
     }
     if (props.router) {
         result.router = await (0, core_1.getEndpoints)();

package/dist/functions/describe.mjs

@@ -1,8 +1,8 @@
 "use strict";
-import { createContext, preloadDescription, getEndpoints, isValidCollection } from "@aeriajs/core";
+import { createContext, preloadDescription, getEndpoints } from "@aeriajs/core";
 import { getCollections, getAvailableRoles } from "@aeriajs/entrypoint";
 import { Result, ACError, HTTPStatus } from "@aeriajs/types";
-import { serialize, endpointError } from "@aeriajs/common";
+import { serialize, endpointError, isValidCollection } from "@aeriajs/common";
 import { validator } from "@aeriajs/validation";
 import { authenticate } from "../collections/user/authenticate.mjs";
 const [Payload, validatePayload] = validator({
@@ -31,7 +31,9 @@ const [Payload, validatePayload] = validator({
   }
 });
 export const describe = async (contextOrPayload) => {
-  const result = {};
+  const result = {
+    descriptions: {}
+  };
   let props;
   if ("request" in contextOrPayload) {
     const { error, result: validatedPayload } = validatePayload(contextOrPayload.request.payload);
@@ -78,6 +80,9 @@ export const describe = async (contextOrPayload) => {
     const userRolesProperty = userCollection.description.properties.roles;
     const userRoles = "enum" in userRolesProperty.items ? userRolesProperty.items.enum : [];
     result.roles = Array.from(new Set(userRoles.concat(await getAvailableRoles())));
+    if ("config" in contextOrPayload) {
+      result.rolesHierarchy = contextOrPayload.config.security.rolesHierarchy;
+    }
   }
   if (props.router) {
     result.router = await getEndpoints();

package/dist/index.d.ts

@@ -707,7 +707,17 @@ export declare const collections: {
             } & {
                 httpStatus: import("@aeriajs/types").HTTPStatus.Forbidden;
             }>>;
-            readonly insert: (payload: NoInfer<import("@aeriajs/types").InsertPayload<import("@aeriajs/types").SchemaWithId<import("@aeriajs/types").Description>>>, context: Omit<import("@aeriajs/types").Context, "token">) => Promise<import("@aeriajs/types").InsertReturnType<import("@aeriajs/types").SchemaWithId<import("@aeriajs/types").Description>>>;
+            readonly insert: (payload: NoInfer<import("@aeriajs/types").InsertPayload<import("@aeriajs/types").SchemaWithId<import("@aeriajs/types").Description>>>, context: Omit<import("@aeriajs/types").Context, "token">) => Promise<import("@aeriajs/types").Result.Error<{
+                readonly code: import("@aeriajs/types").ACError.AuthorizationError;
+                readonly message: "user is not allowed to edit other users roles";
+            } & {
+                httpStatus: import("@aeriajs/types").HTTPStatus.Forbidden;
+            }> | import("@aeriajs/types").Result.Error<{
+                readonly code: import("@aeriajs/types").ACError.AuthorizationError;
+                readonly message: "tried to set unallowed roles";
+            } & {
+                httpStatus: import("@aeriajs/types").HTTPStatus.Forbidden;
+            }> | import("@aeriajs/types").InsertReturnType<import("@aeriajs/types").SchemaWithId<import("@aeriajs/types").Description>>>;
             readonly editProfile: (payload: Partial<import("@aeriajs/types").PackReferences<import("@aeriajs/types").SchemaWithId<{
                 readonly $id: "user";
                 readonly icon: "users";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aeriajs/builtins",
-  "version": "0.0.228",
+  "version": "0.0.229",
   "description": "## Installation",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -55,10 +55,10 @@
     "mongodb": "^6.5.0"
   },
   "peerDependencies": {
-    "@aeriajs/core": "^0.0.228",
-    "@aeriajs/common": "^0.0.130",
-    "@aeriajs/entrypoint": "^0.0.133",
-    "@aeriajs/types": "^0.0.112",
-    "@aeriajs/validation": "^0.0.145"
+    "@aeriajs/core": "^0.0.229",
+    "@aeriajs/common": "^0.0.131",
+    "@aeriajs/entrypoint": "^0.0.134",
+    "@aeriajs/types": "^0.0.113",
+    "@aeriajs/validation": "^0.0.146"
   }
 }