@albirex/platformatic-logto 1.2.5 → 1.3.2

package/lib/index.cjs

@@ -0,0 +1,2 @@
+var Z=Object.create;var q=Object.defineProperty;var Y=Object.getOwnPropertyDescriptor;var J=Object.getOwnPropertyNames;var Q=Object.getPrototypeOf,V=Object.prototype.hasOwnProperty;var x=(e,t)=>{for(var o in t)q(e,o,{get:t[o],enumerable:!0})},_=(e,t,o,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let r of J(t))!V.call(e,r)&&r!==o&&q(e,r,{get:()=>t[r],enumerable:!(n=Y(t,r))||n.enumerable});return e};var O=(e,t,o)=>(o=e!=null?Z(Q(e)):{},_(t||!e||!e.__esModule?q(o,"default",{value:e,enumerable:!0}):o,e)),ee=e=>_(q({},"__esModule",{value:!0}),e);var ie={};x(ie,{default:()=>re});module.exports=ee(ie);var G=O(require("fastify-plugin"),1),W=O(require("leven"),1),oe=O(require("fastify-user"),1);function te(e,t){let o=null;for(let n of e){for(let r of t)if(n.role===r){o=n;break}if(o)break}return o}var $=te;function A(e){if(e&&!e.reply)throw new Error("Missing reply in context. You should call this function with { ctx: { reply }}");return e.reply.request}function D(e,t,o,n=!1){let r=[],c=e.user;if(!c)return r.push(o),r;let a;if(n){let h=t.split(".");a=c;for(let F of h)a=a[F]}else a=c[t];return typeof a=="string"?r=a.split(","):Array.isArray(a)&&(r=a),r.length===0&&r.push(o),r}var T=O(require("@fastify/error"),1),S="PLT_DB_AUTH",b=(0,T.default)(`${S}_UNAUTHORIZED`,"operation not allowed",401),C=(0,T.default)(`${S}_FIELD_UNAUTHORIZED`,"field not allowed: %s",401),z=(0,T.default)(`${S}_NOT_NULLABLE_MISSING`,'missing not nullable field: "%s" in save rule for entity "%s"');var X=O(require("@albirex/fastify-logto"),1),N="platformatic-admin";async function se(e,t){e.register(X.default,{endpoint:t.logtoBaseUrl||"https://auth.example.com",appId:t.logtoAppId||"your-app-id",appSecret:t.logtoAppSecret||"your-app-secret"}),await e.register(oe,t.jwtPlugin);let o=t.adminSecret,n=t.rolePath||t.roleKey||"X-PLATFORMATIC-ROLE",r=t.userPath||t.userKey||"X-PLATFORMATIC-USER-ID",c=!!t.rolePath,a=t.anonymousRole||"anonymous";async function h(){let R=await e.logto.callAPI("/api/roles?type=User","GET");if(!R.ok)throw R;let P=await R.json(),f=[{role:a,entities:Object.keys(e.platformatic.entities),find:t.allowAnonymous,save:t.allowAnonymous,delete:t.allowAnonymous}];for(let l of P){let d=await e.logto.callAPI(`/api/roles/${l.id}/scopes`,"GET");if(!d.ok)throw d;let w=await d.json();for(let I of w){let g=l.name,[i,s]=I.name.split(":");if(!e.platformatic.entities[s]){let y=L(s);e.log.warn(`Unknown entity '${s}' in authorization rule. Did you mean '${y.entity}'?`);continue}let m=f.find(y=>y.role===g&&y.entity===s);if(m)t.checks?m[i]={checks:{userId:r}}:m[i]=!0;else{let y={role:g,entity:s};t.checks?y[i]={checks:{userId:r}}:y[i]=!0,t.defaults&&(y.defaults={userId:r}),f.push(y)}}}return e.log.debug("LogTo calculated rules"),e.log.debug(f),f}e.decorateRequest("setupDBAuthorizationUser",F);async function F(){await this.extractUser();let R=!1;o&&this.headers["x-platformatic-admin-secret"]===o&&(t.jwtPlugin.jwt?R=!0:(this.log.info("admin secret is valid"),this.user=new Proxy(this.headers,{get:(P,f)=>{let l;if(P[f.toString()])l=P[f.toString()];else{let d=f.toString().toLowerCase();l=P[d]}return!l&&f.toString().toLowerCase()===n.toLowerCase()&&(l=N),l}}))),R&&(this.user={[n]:N})}function L(R){return Object.keys(e.platformatic.entities).reduce((l,d)=>{let w=(0,W.default)(R,d);return w<l.distance&&(l.distance=w,l.entity=d),l},{distance:1/0,entity:null})}e.addHook("onReady",async function(){let R=await h(),P={};for(let f=0;f<R.length;f++){let l=R[f],d=null;if(l.entity)d=[l.entity];else if(l.entities)d=[...l.entities];else throw new Error(`Missing entity in authorization rule ${f}`);for(let w of d){let I={...l,entity:w,entities:void 0};if(!e.platformatic.entities[I.entity]){let g=L(w);throw new Error(`Unknown entity '${w}' in authorization rule ${f}. Did you mean '${g.entity}'?`)}P[w]||(P[w]=[]),P[w].push(I)}}for(let f of Object.keys(e.platformatic.entities)){let l=P[f]||[],d=e.platformatic.entities[f];if(void 0&&!1)throw new Error(`Subscription for entity "${f}" have conflictling rules across roles`);o&&l.push({role:N,find:!0,save:!0,delete:!0}),ne(d,l),e.platformatic.addEntityHooks(f,{async find(g,{where:i,ctx:s,fields:m,...y}={}){let p=A(s),u=await v(s,l,n,a,c);return M(u.find,m||Object.keys(e.platformatic.entities[f].fields)),i=await K(s,u.find,i,p.user),g({...y,where:i,ctx:s,fields:m})},async save(g,{input:i,ctx:s,fields:m,...y}){let p=A(s),u=await v(s,l,n,a,c);if(!u.save)throw new b;if(M(u.save,m),H(u.save,i),u.defaults)for(let k of Object.keys(u.defaults)){let j=u.defaults[k];typeof j=="function"?i[k]=await j({user:p.user,ctx:s,input:i}):i[k]=p.user[j]}let U=i[d.primaryKey]!==void 0,E={};if(E[d.primaryKey]={eq:i[d.primaryKey]},U){let k=await K(s,u.save,E,p.user);if((await d.find({where:k,ctx:s,fields:m})).length===0)throw new b;return g({input:i,ctx:s,fields:m,...y})}return g({input:i,ctx:s,fields:m,...y})},async insert(g,{inputs:i,ctx:s,fields:m,...y}){let p=A(s),u=await v(s,l,n,a,c);if(!u.save)throw new b;if(M(u.save,m),H(u.save,i),u.defaults)for(let U of i)for(let E of Object.keys(u.defaults)){let k=u.defaults[E];typeof k=="function"?U[E]=await k({user:p.user,ctx:s,input:U}):U[E]=p.user[k]}return g({inputs:i,ctx:s,fields:m,...y})},async delete(g,{where:i,ctx:s,fields:m,...y}){let p=A(s),u=await v(s,l,n,a,c);return i=await K(s,u.delete,i,p.user),g({where:i,ctx:s,fields:m,...y})},async updateMany(g,{where:i,ctx:s,fields:m,...y}){let p=A(s),u=await v(s,l,n,a,c);return i=await K(s,u.updateMany,i,p.user),g({...y,where:i,ctx:s,fields:m})}})}})}async function K(e,t,o,n){if(!t)throw new b;let r=A(e);if(o=o||{},typeof t=="object"){let{checks:c}=t;if(c)for(let a of Object.keys(c)){let h=c[a];if(typeof h=="string")o[a]={eq:r.user[h]};else for(let F of Object.keys(h)){let L=h[F];o[a]={[F]:r.user[L]}}}}else typeof t=="function"&&(o=await t({user:n,ctx:e,where:o}));return o}async function v(e,t,o,n,r=!1){let c=A(e);await c.setupDBAuthorizationUser();let a=D(c,o,n,r),h=$(t,a);if(!h)throw e.reply.request.log.warn({roles:a,rules:t},"no rule for roles"),new b;return e.reply.request.log.trace({roles:a,rule:h},"found rule"),h}function M(e,t){if(!e)throw new b;let{fields:o}=e;if(o){for(let n of t)if(!o.includes(n))throw new C(n)}}var B=(e,t)=>{for(let o of e){let n=Object.keys(o);for(let r of n)if(!t.includes(r))throw new C(r)}};function H(e,t){let{fields:o}=e;o&&(Array.isArray(t)?B(t,o):B([t],o))}function ne(e,t){let o=Object.values(e.fields).filter(n=>!n.isNullable&&!n.primaryKey).map(({camelcase:n})=>n);for(let n of t){let{entity:r,save:c}=n;if(c&&c.fields){let a=c.fields;for(let h of o)if(!a.includes(h))throw new z(h,r)}}}var re=(0,G.default)(se);
+//# sourceMappingURL=index.cjs.map

package/lib/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/utils/find-rule.ts","../src/utils/utils.ts","../src/utils/errors.ts"],"sourcesContent":["import fp from 'fastify-plugin'\nimport leven from 'leven'\nimport * as fastifyUser from 'fastify-user'\n\nimport findRule from './utils/find-rule.js'\nimport { getRequestFromContext, getRoles } from './utils/utils.js'\nimport { Unauthorized, UnauthorizedField, MissingNotNullableError } from './utils/errors.js'\nimport fastifyLogto from '@albirex/fastify-logto';\nimport { FastifyInstance } from 'fastify'\nimport type { FastifyUserPluginOptions } from 'fastify-user';\nimport type { Entity, PlatformaticContext } from '@platformatic/sql-mapper'\n\nconst PLT_ADMIN_ROLE = 'platformatic-admin'\n\nexport type PlatformaticRule = {\n    role: string;\n    entity?: string;\n    entities?: string[];\n    defaults?: Record<string, string>;\n    checks?: boolean;\n    find?: boolean;\n    save?: boolean;\n    delete?: boolean;\n\n};\n\nexport type PlatformaticLogtoAuthOptions = {\n    logtoBaseUrl?: string;\n    logtoAppId?: string;\n    logtoAppSecret?: string;\n    adminSecret?: string;\n    rolePath?: string;\n    roleKey?: string;\n    userPath?: string;\n    userKey?: string;\n    anonymousRole?: string;\n    allowAnonymous?: boolean;\n    checks?: boolean;\n    defaults?: boolean;\n    jwtPlugin: FastifyUserPluginOptions\n};\n\nasync function auth(app: FastifyInstance, opts: PlatformaticLogtoAuthOptions) {\n    app.register(fastifyLogto, {\n        endpoint: opts.logtoBaseUrl || 'https://auth.example.com',\n        appId: opts.logtoAppId || 'your-app-id',\n        appSecret: opts.logtoAppSecret || 'your-app-secret',\n    });\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    await app.register(fastifyUser as any, opts.jwtPlugin);\n\n    const adminSecret = opts.adminSecret\n    const roleKey = opts.rolePath || opts.roleKey || 'X-PLATFORMATIC-ROLE'\n    const userKey = opts.userPath || opts.userKey || 'X-PLATFORMATIC-USER-ID'\n    const isRolePath = !!opts.rolePath // if `true` the role is intepreted as path like `user.role`\n    const anonymousRole = opts.anonymousRole || 'anonymous'\n\n    async function composeLogToRules() {\n        const rolesResp = await app.logto.callAPI('/api/roles?type=User', 'GET');\n\n        if (!rolesResp.ok) {\n            throw rolesResp;\n        }\n\n        const roles = await rolesResp.json();\n        const rules: PlatformaticRule[] = [{\n            role: anonymousRole,\n            entities: Object.keys(app.platformatic.entities),\n            find: opts.allowAnonymous,\n            save: opts.allowAnonymous,\n            delete: opts.allowAnonymous,\n        }];\n\n        for (const role of roles) {\n            const scopesResp = await app.logto.callAPI(`/api/roles/${role.id}/scopes`, 'GET');\n\n            if (!scopesResp.ok) {\n                throw scopesResp;\n            }\n\n            const scopes = await scopesResp.json();\n\n            for (const scope of scopes) {\n                const roleName = role.name;\n                const [scopeAction, entity] = scope.name.split(':');\n\n                if (!app.platformatic.entities[entity]) {\n                    const nearest = findNearestEntity(entity)\n                    app.log.warn(`Unknown entity '${entity}' in authorization rule. Did you mean '${nearest.entity}'?`)\n                    continue;\n                }\n\n                const checkExists = rules.find(r => r.role === roleName && r.entity === entity);\n                if (checkExists) {\n                    if (opts.checks) {\n                        checkExists[scopeAction] = {\n                            checks: {\n                                userId: userKey\n                            }\n                        };\n                    } else {\n                        checkExists[scopeAction] = true;\n                    }\n                } else {\n                    const newRule: PlatformaticRule = {\n                        role: roleName,\n                        entity,\n                    };\n\n                    if (opts.checks) {\n                        newRule[scopeAction] = {\n                            checks: {\n                                userId: userKey\n                            }\n                        };\n                    } else {\n                        newRule[scopeAction] = true;\n                    }\n\n                    if (opts.defaults) {\n                        newRule.defaults = {\n                            userId: userKey\n                        };\n                    }\n\n                    rules.push(newRule);\n                }\n            }\n        }\n\n        app.log.debug('LogTo calculated rules');\n        app.log.debug(rules);\n        return rules;\n    }\n\n    app.decorateRequest('setupDBAuthorizationUser', setupUser)\n\n    async function setupUser() {\n        // if (!adminSecret) {\n        await this.extractUser()\n        // }\n\n        let forceAdminRole = false\n        if (adminSecret && this.headers['x-platformatic-admin-secret'] === adminSecret) {\n            if (opts.jwtPlugin.jwt) {\n                forceAdminRole = true\n            } else {\n                this.log.info('admin secret is valid')\n                this.user = new Proxy(this.headers, {\n                    get: (target, key) => {\n                        let value;\n                        if (!target[key.toString()]) {\n                            const newKey = key.toString().toLowerCase()\n                            value = target[newKey]\n                        } else {\n                            value = target[key.toString()]\n                        }\n\n                        if (!value && key.toString().toLowerCase() === roleKey.toLowerCase()) {\n                            value = PLT_ADMIN_ROLE\n                        }\n                        return value\n                    },\n                })\n            }\n        }\n\n        if (forceAdminRole) {\n            // We replace just the role in `request.user`, all the rest is untouched\n            this.user = {\n                // ...request.user,\n                [roleKey]: PLT_ADMIN_ROLE,\n            }\n        }\n    }\n\n    function findNearestEntity(ruleEntity) {\n        // There is an unknown entity. Let's find out the nearest one for a nice error message\n        const entities = Object.keys(app.platformatic.entities)\n\n        const nearest = entities.reduce((acc, entity) => {\n            const distance = leven(ruleEntity, entity)\n            if (distance < acc.distance) {\n                acc.distance = distance\n                acc.entity = entity\n            }\n            return acc\n        }, { distance: Infinity, entity: null })\n        return nearest\n    }\n\n    app.addHook('onReady', async function () {\n        const rules = await composeLogToRules();\n\n        // TODO validate that there is at most a rule for a given role\n        const entityRules = {};\n        for (let i = 0; i < rules.length; i++) {\n            const rule = rules[i]\n\n            let ruleEntities = null\n            if (rule.entity) {\n                ruleEntities = [rule.entity]\n            } else if (rule.entities) {\n                ruleEntities = [...rule.entities]\n            } else {\n                throw new Error(`Missing entity in authorization rule ${i}`)\n            }\n\n            for (const ruleEntity of ruleEntities) {\n                const newRule = { ...rule, entity: ruleEntity, entities: undefined }\n                if (!app.platformatic.entities[newRule.entity]) {\n                    const nearest = findNearestEntity(ruleEntity)\n                    throw new Error(`Unknown entity '${ruleEntity}' in authorization rule ${i}. Did you mean '${nearest.entity}'?`)\n                }\n\n                if (!entityRules[ruleEntity]) {\n                    entityRules[ruleEntity] = []\n                }\n                entityRules[ruleEntity].push(newRule)\n            }\n        }\n\n        for (const entityKey of Object.keys(app.platformatic.entities)) {\n            const rules = entityRules[entityKey] || []\n            const type = app.platformatic.entities[entityKey]\n\n            // We have subscriptions!\n            let userPropToFillForPublish\n            const topicsWithoutChecks = false\n\n            // mqtt\n            // if (app.platformatic.mq) {\n            //     for (const rule of rules) {\n            //         const checks = rule.find?.checks\n            //         if (typeof checks !== 'object') {\n            //             topicsWithoutChecks = !!rule.find\n            //             continue\n            //         }\n            //         const keys = Object.keys(checks)\n            //         if (keys.length !== 1) {\n            //             throw new Error(`Subscription requires that the role \"${rule.role}\" has only one check in the find rule for entity \"${rule.entity}\"`)\n            //         }\n            //         const key = keys[0]\n\n            //         const val = typeof checks[key] === 'object' ? checks[key].eq : checks[key]\n            //         if (userPropToFillForPublish && userPropToFillForPublish.val !== val) {\n            //             throw new Error('Unable to configure subscriptions and authorization due to multiple check clauses in find')\n            //         }\n            //         userPropToFillForPublish = { key, val }\n            //     }\n            // }\n\n            if (userPropToFillForPublish && topicsWithoutChecks) {\n                throw new Error(`Subscription for entity \"${entityKey}\" have conflictling rules across roles`)\n            }\n\n            // MUST set this after doing the security checks on the subscriptions\n            if (adminSecret) {\n                rules.push({\n                    role: PLT_ADMIN_ROLE,\n                    find: true,\n                    save: true,\n                    delete: true,\n                })\n            }\n\n            // If we have `fields` in save rules, we need to check if all the not-nullable\n            // fields are specified\n            checkSaveMandatoryFieldsInRules(type, rules)\n\n            // function useOriginal(skipAuth: boolean, ctx: PlatformaticContext) {\n            //     if (skipAuth === false && !ctx) {\n            //         throw new Error('Cannot set skipAuth to `false` without ctx')\n            //     }\n\n            //     return skipAuth || !ctx\n            // }\n\n            app.platformatic.addEntityHooks(entityKey, {\n                async find(originalFind, { where, ctx, fields, ...restOpts } = {}) {\n                    // if (useOriginal(skipAuth, ctx)) {\n                    //     return originalFind({ ...restOpts, where, ctx, fields })\n                    // }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n                    checkFieldsFromRule(rule.find, fields || Object.keys(app.platformatic.entities[entityKey].fields))\n                    where = await fromRuleToWhere(ctx, rule.find, where, request.user)\n\n                    return originalFind({ ...restOpts, where, ctx, fields })\n                },\n                async save(originalSave, { input, ctx, fields, ...restOpts }) {\n                    // if (useOriginal(skipAuth, ctx)) {\n                    //     return originalSave({ ctx, input, fields, ...restOpts })\n                    // }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n\n                    if (!rule.save) {\n                        throw new Unauthorized()\n                    }\n                    checkFieldsFromRule(rule.save, fields)\n                    checkInputFromRuleFields(rule.save, input)\n\n                    if (rule.defaults) {\n                        for (const key of Object.keys(rule.defaults)) {\n                            const defaults = rule.defaults[key]\n                            if (typeof defaults === 'function') {\n                                input[key] = await defaults({ user: request.user, ctx, input })\n                            } else {\n                                input[key] = request.user[defaults]\n                            }\n                        }\n                    }\n\n                    const hasAllPrimaryKeys = input[type.primaryKey] !== undefined;\n                    const whereConditions = {}\n                    whereConditions[type.primaryKey] = { eq: input[type.primaryKey] }\n\n                    if (hasAllPrimaryKeys) {\n                        const where = await fromRuleToWhere(ctx, rule.save, whereConditions, request.user)\n\n                        const found = await type.find({\n                            where,\n                            ctx,\n                            fields,\n                        })\n\n                        if (found.length === 0) {\n                            throw new Unauthorized()\n                        }\n\n                        return originalSave({ input, ctx, fields, ...restOpts })\n                    }\n\n                    return originalSave({ input, ctx, fields, ...restOpts })\n                },\n\n                async insert(originalInsert, { inputs, ctx, fields, ...restOpts }) {\n                    // if (useOriginal(skipAuth, ctx)) {\n                    //     return originalInsert({ inputs, ctx, fields, ...restOpts })\n                    // }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n\n                    if (!rule.save) {\n                        throw new Unauthorized()\n                    }\n\n                    checkFieldsFromRule(rule.save, fields)\n                    checkInputFromRuleFields(rule.save, inputs)\n\n                    /* istanbul ignore else */\n                    if (rule.defaults) {\n                        for (const input of inputs) {\n                            for (const key of Object.keys(rule.defaults)) {\n                                const defaults = rule.defaults[key]\n                                if (typeof defaults === 'function') {\n                                    input[key] = await defaults({ user: request.user, ctx, input })\n                                } else {\n                                    input[key] = request.user[defaults]\n                                }\n                            }\n                        }\n                    }\n\n                    return originalInsert({ inputs, ctx, fields, ...restOpts })\n                },\n\n                async delete(originalDelete, { where, ctx, fields, ...restOpts }) {\n                    // if (useOriginal(skipAuth, ctx)) {\n                    //     return originalDelete({ where, ctx, fields, ...restOpts })\n                    // }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n\n                    where = await fromRuleToWhere(ctx, rule.delete, where, request.user)\n\n                    return originalDelete({ where, ctx, fields, ...restOpts })\n                },\n\n                async updateMany(originalUpdateMany, { where, ctx, fields, ...restOpts }) {\n                    // if (useOriginal(skipAuth, ctx)) {\n                    //     return originalUpdateMany({ ...restOpts, where, ctx, fields })\n                    // }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n\n                    where = await fromRuleToWhere(ctx, rule.updateMany, where, request.user)\n\n                    return originalUpdateMany({ ...restOpts, where, ctx, fields })\n                },\n            })\n        }\n    })\n}\n\nasync function fromRuleToWhere(ctx: PlatformaticContext, rule, where, user) {\n    if (!rule) {\n        throw new Unauthorized()\n    }\n    const request = getRequestFromContext(ctx)\n    /* istanbul ignore next */\n    where = where || {}\n\n    if (typeof rule === 'object') {\n        const { checks } = rule\n\n        /* istanbul ignore else */\n        if (checks) {\n            for (const key of Object.keys(checks)) {\n                const clauses = checks[key]\n                if (typeof clauses === 'string') {\n                    // case: \"userId\": \"X-PLATFORMATIC-USER-ID\"\n                    where[key] = {\n                        eq: request.user[clauses],\n                    }\n                } else {\n                    // case:\n                    // userId: {\n                    //   eq: 'X-PLATFORMATIC-USER-ID'\n                    // }\n                    for (const clauseKey of Object.keys(clauses)) {\n                        const clause = clauses[clauseKey]\n                        where[key] = {\n                            [clauseKey]: request.user[clause],\n                        }\n                    }\n                }\n            }\n        }\n    } else if (typeof rule === 'function') {\n        where = await rule({ user, ctx, where })\n    }\n    return where\n}\n\nasync function findRuleForRequestUser(ctx: PlatformaticContext, rules: PlatformaticRule[], roleKey: string, anonymousRole: string, isRolePath = false) {\n    const request = getRequestFromContext(ctx)\n    await request.setupDBAuthorizationUser()\n    const roles = getRoles(request, roleKey, anonymousRole, isRolePath)\n    const rule = findRule(rules, roles)\n    if (!rule) {\n        ctx.reply.request.log.warn({ roles, rules }, 'no rule for roles')\n        throw new Unauthorized()\n    }\n    ctx.reply.request.log.trace({ roles, rule }, 'found rule')\n    return rule\n}\n\nfunction checkFieldsFromRule(rule, fields) {\n    if (!rule) {\n        throw new Unauthorized()\n    }\n    const { fields: fieldsFromRule } = rule\n    /* istanbul ignore else */\n    if (fieldsFromRule) {\n        for (const field of fields) {\n            if (!fieldsFromRule.includes(field)) {\n                throw new UnauthorizedField(field)\n            }\n        }\n    }\n}\n\nconst validateInputs = (inputs, fieldsFromRule) => {\n    for (const input of inputs) {\n        const inputFields = Object.keys(input)\n        for (const inputField of inputFields) {\n            if (!fieldsFromRule.includes(inputField)) {\n                throw new UnauthorizedField(inputField)\n            }\n        }\n    }\n}\n\nfunction checkInputFromRuleFields(rule, inputs) {\n    const { fields: fieldsFromRule } = rule\n    /* istanbul ignore else */\n    if (fieldsFromRule) {\n        if (!Array.isArray(inputs)) {\n            // save\n            validateInputs([inputs], fieldsFromRule)\n        } else {\n            // insert\n            validateInputs(inputs, fieldsFromRule)\n        }\n    }\n}\n\nfunction checkSaveMandatoryFieldsInRules(type: Entity, rules) {\n    // List of not nullable, not PKs field to validate save/insert when allowed fields are specified on the rule\n    const mandatoryFields =\n        Object.values(type.fields)\n            .filter(k => (!k.isNullable && !k.primaryKey))\n            .map(({ camelcase }) => (camelcase))\n\n    for (const rule of rules) {\n        const { entity, save } = rule\n        if (save && save.fields) {\n            const fields = save.fields\n            for (const mField of mandatoryFields) {\n                if (!fields.includes(mField)) {\n                    throw new MissingNotNullableError(mField, entity)\n                }\n            }\n        }\n    }\n}\n\nexport default fp(auth)\n","'use strict'\n\nimport { PlatformaticRule } from '../index.js'\n\nfunction findRule(rules: PlatformaticRule[], roles: string[]) {\n  let found = null\n  for (const rule of rules) {\n    for (const role of roles) {\n      if (rule.role === role) {\n        found = rule\n        break\n      }\n    }\n    if (found) {\n      break\n    }\n  }\n  return found\n}\n\nexport default findRule\n","'use strict'\n\nexport function getRequestFromContext (ctx) {\n  if (ctx && !ctx.reply) {\n    throw new Error('Missing reply in context. You should call this function with { ctx: { reply }}')\n  }\n  return ctx.reply.request\n}\n\nexport function getRoles (request, roleKey, anonymousRole, isRolePath = false) {\n  let output = []\n  const user = request.user\n  if (!user) {\n    output.push(anonymousRole)\n    return output\n  }\n\n  let rolesRaw\n  if (isRolePath) {\n    const roleKeys = roleKey.split('.')\n    rolesRaw = user\n    for (const key of roleKeys) {\n      rolesRaw = rolesRaw[key]\n    }\n  } else {\n    rolesRaw = user[roleKey]\n  }\n\n  if (typeof rolesRaw === 'string') {\n    output = rolesRaw.split(',')\n  } else if (Array.isArray(rolesRaw)) {\n    output = rolesRaw\n  }\n  if (output.length === 0) {\n    output.push(anonymousRole)\n  }\n\n  return output\n}\n","'use strict'\n\nimport createError from '@fastify/error'\n\nconst ERROR_PREFIX = 'PLT_DB_AUTH'\n\nexport const Unauthorized = createError(`${ERROR_PREFIX}_UNAUTHORIZED`, 'operation not allowed', 401)\nexport const UnauthorizedField = createError(`${ERROR_PREFIX}_FIELD_UNAUTHORIZED`, 'field not allowed: %s', 401)\nexport const MissingNotNullableError = createError(`${ERROR_PREFIX}_NOT_NULLABLE_MISSING`, 'missing not nullable field: \"%s\" in save rule for entity \"%s\"')\n"],"mappings":"8iBAAA,IAAAA,GAAA,GAAAC,EAAAD,GAAA,aAAAE,KAAA,eAAAC,GAAAH,IAAA,IAAAI,EAAe,+BACfC,EAAkB,sBAClBC,GAA6B,6BCE7B,SAASC,GAASC,EAA2BC,EAAiB,CAC5D,IAAIC,EAAQ,KACZ,QAAWC,KAAQH,EAAO,CACxB,QAAWI,KAAQH,EACjB,GAAIE,EAAK,OAASC,EAAM,CACtBF,EAAQC,EACR,KACF,CAEF,GAAID,EACF,KAEJ,CACA,OAAOA,CACT,CAEA,IAAOG,EAAQN,GClBR,SAASO,EAAuBC,EAAK,CAC1C,GAAIA,GAAO,CAACA,EAAI,MACd,MAAM,IAAI,MAAM,gFAAgF,EAElG,OAAOA,EAAI,MAAM,OACnB,CAEO,SAASC,EAAUC,EAASC,EAASC,EAAeC,EAAa,GAAO,CAC7E,IAAIC,EAAS,CAAC,EACRC,EAAOL,EAAQ,KACrB,GAAI,CAACK,EACH,OAAAD,EAAO,KAAKF,CAAa,EAClBE,EAGT,IAAIE,EACJ,GAAIH,EAAY,CACd,IAAMI,EAAWN,EAAQ,MAAM,GAAG,EAClCK,EAAWD,EACX,QAAWG,KAAOD,EAChBD,EAAWA,EAASE,CAAG,CAE3B,MACEF,EAAWD,EAAKJ,CAAO,EAGzB,OAAI,OAAOK,GAAa,SACtBF,EAASE,EAAS,MAAM,GAAG,EAClB,MAAM,QAAQA,CAAQ,IAC/BF,EAASE,GAEPF,EAAO,SAAW,GACpBA,EAAO,KAAKF,CAAa,EAGpBE,CACT,CCpCA,IAAAK,EAAwB,+BAElBC,EAAe,cAERC,KAAe,EAAAC,SAAY,GAAGF,CAAY,gBAAiB,wBAAyB,GAAG,EACvFG,KAAoB,EAAAD,SAAY,GAAGF,CAAY,sBAAuB,wBAAyB,GAAG,EAClGI,KAA0B,EAAAF,SAAY,GAAGF,CAAY,wBAAyB,+DAA+D,EHD1J,IAAAK,EAAyB,uCAKnBC,EAAiB,qBA8BvB,eAAeC,GAAKC,EAAsBC,EAAoC,CAC1ED,EAAI,SAAS,EAAAE,QAAc,CACvB,SAAUD,EAAK,cAAgB,2BAC/B,MAAOA,EAAK,YAAc,cAC1B,UAAWA,EAAK,gBAAkB,iBACtC,CAAC,EAED,MAAMD,EAAI,SAASG,GAAoBF,EAAK,SAAS,EAErD,IAAMG,EAAcH,EAAK,YACnBI,EAAUJ,EAAK,UAAYA,EAAK,SAAW,sBAC3CK,EAAUL,EAAK,UAAYA,EAAK,SAAW,yBAC3CM,EAAa,CAAC,CAACN,EAAK,SACpBO,EAAgBP,EAAK,eAAiB,YAE5C,eAAeQ,GAAoB,CAC/B,IAAMC,EAAY,MAAMV,EAAI,MAAM,QAAQ,uBAAwB,KAAK,EAEvE,GAAI,CAACU,EAAU,GACX,MAAMA,EAGV,IAAMC,EAAQ,MAAMD,EAAU,KAAK,EAC7BE,EAA4B,CAAC,CAC/B,KAAMJ,EACN,SAAU,OAAO,KAAKR,EAAI,aAAa,QAAQ,EAC/C,KAAMC,EAAK,eACX,KAAMA,EAAK,eACX,OAAQA,EAAK,cACjB,CAAC,EAED,QAAWY,KAAQF,EAAO,CACtB,IAAMG,EAAa,MAAMd,EAAI,MAAM,QAAQ,cAAca,EAAK,EAAE,UAAW,KAAK,EAEhF,GAAI,CAACC,EAAW,GACZ,MAAMA,EAGV,IAAMC,EAAS,MAAMD,EAAW,KAAK,EAErC,QAAWE,KAASD,EAAQ,CACxB,IAAME,EAAWJ,EAAK,KAChB,CAACK,EAAaC,CAAM,EAAIH,EAAM,KAAK,MAAM,GAAG,EAElD,GAAI,CAAChB,EAAI,aAAa,SAASmB,CAAM,EAAG,CACpC,IAAMC,EAAUC,EAAkBF,CAAM,EACxCnB,EAAI,IAAI,KAAK,mBAAmBmB,CAAM,0CAA0CC,EAAQ,MAAM,IAAI,EAClG,QACJ,CAEA,IAAME,EAAcV,EAAM,KAAKW,GAAKA,EAAE,OAASN,GAAYM,EAAE,SAAWJ,CAAM,EAC9E,GAAIG,EACIrB,EAAK,OACLqB,EAAYJ,CAAW,EAAI,CACvB,OAAQ,CACJ,OAAQZ,CACZ,CACJ,EAEAgB,EAAYJ,CAAW,EAAI,OAE5B,CACH,IAAMM,EAA4B,CAC9B,KAAMP,EACN,OAAAE,CACJ,EAEIlB,EAAK,OACLuB,EAAQN,CAAW,EAAI,CACnB,OAAQ,CACJ,OAAQZ,CACZ,CACJ,EAEAkB,EAAQN,CAAW,EAAI,GAGvBjB,EAAK,WACLuB,EAAQ,SAAW,CACf,OAAQlB,CACZ,GAGJM,EAAM,KAAKY,CAAO,CACtB,CACJ,CACJ,CAEA,OAAAxB,EAAI,IAAI,MAAM,wBAAwB,EACtCA,EAAI,IAAI,MAAMY,CAAK,EACZA,CACX,CAEAZ,EAAI,gBAAgB,2BAA4ByB,CAAS,EAEzD,eAAeA,GAAY,CAEvB,MAAM,KAAK,YAAY,EAGvB,IAAIC,EAAiB,GACjBtB,GAAe,KAAK,QAAQ,6BAA6B,IAAMA,IAC3DH,EAAK,UAAU,IACfyB,EAAiB,IAEjB,KAAK,IAAI,KAAK,uBAAuB,EACrC,KAAK,KAAO,IAAI,MAAM,KAAK,QAAS,CAChC,IAAK,CAACC,EAAQC,IAAQ,CAClB,IAAIC,EACJ,GAAKF,EAAOC,EAAI,SAAS,CAAC,EAItBC,EAAQF,EAAOC,EAAI,SAAS,CAAC,MAJJ,CACzB,IAAME,EAASF,EAAI,SAAS,EAAE,YAAY,EAC1CC,EAAQF,EAAOG,CAAM,CACzB,CAIA,MAAI,CAACD,GAASD,EAAI,SAAS,EAAE,YAAY,IAAMvB,EAAQ,YAAY,IAC/DwB,EAAQ/B,GAEL+B,CACX,CACJ,CAAC,IAILH,IAEA,KAAK,KAAO,CAER,CAACrB,CAAO,EAAGP,CACf,EAER,CAEA,SAASuB,EAAkBU,EAAY,CAYnC,OAViB,OAAO,KAAK/B,EAAI,aAAa,QAAQ,EAE7B,OAAO,CAACgC,EAAKb,IAAW,CAC7C,IAAMc,KAAW,EAAAC,SAAMH,EAAYZ,CAAM,EACzC,OAAIc,EAAWD,EAAI,WACfA,EAAI,SAAWC,EACfD,EAAI,OAASb,GAEVa,CACX,EAAG,CAAE,SAAU,IAAU,OAAQ,IAAK,CAAC,CAE3C,CAEAhC,EAAI,QAAQ,UAAW,gBAAkB,CACrC,IAAMY,EAAQ,MAAMH,EAAkB,EAGhC0B,EAAc,CAAC,EACrB,QAASC,EAAI,EAAGA,EAAIxB,EAAM,OAAQwB,IAAK,CACnC,IAAMC,EAAOzB,EAAMwB,CAAC,EAEhBE,EAAe,KACnB,GAAID,EAAK,OACLC,EAAe,CAACD,EAAK,MAAM,UACpBA,EAAK,SACZC,EAAe,CAAC,GAAGD,EAAK,QAAQ,MAEhC,OAAM,IAAI,MAAM,wCAAwCD,CAAC,EAAE,EAG/D,QAAWL,KAAcO,EAAc,CACnC,IAAMd,EAAU,CAAE,GAAGa,EAAM,OAAQN,EAAY,SAAU,MAAU,EACnE,GAAI,CAAC/B,EAAI,aAAa,SAASwB,EAAQ,MAAM,EAAG,CAC5C,IAAMJ,EAAUC,EAAkBU,CAAU,EAC5C,MAAM,IAAI,MAAM,mBAAmBA,CAAU,2BAA2BK,CAAC,mBAAmBhB,EAAQ,MAAM,IAAI,CAClH,CAEKe,EAAYJ,CAAU,IACvBI,EAAYJ,CAAU,EAAI,CAAC,GAE/BI,EAAYJ,CAAU,EAAE,KAAKP,CAAO,CACxC,CACJ,CAEA,QAAWe,KAAa,OAAO,KAAKvC,EAAI,aAAa,QAAQ,EAAG,CAC5D,IAAMY,EAAQuB,EAAYI,CAAS,GAAK,CAAC,EACnCC,EAAOxC,EAAI,aAAa,SAASuC,CAAS,EA4BhD,GAzBI,QACwB,GAyBxB,MAAM,IAAI,MAAM,4BAA4BA,CAAS,wCAAwC,EAI7FnC,GACAQ,EAAM,KAAK,CACP,KAAMd,EACN,KAAM,GACN,KAAM,GACN,OAAQ,EACZ,CAAC,EAKL2C,GAAgCD,EAAM5B,CAAK,EAU3CZ,EAAI,aAAa,eAAeuC,EAAW,CACvC,MAAM,KAAKG,EAAc,CAAE,MAAAC,EAAO,IAAAC,EAAK,OAAAC,EAAQ,GAAGC,CAAS,EAAI,CAAC,EAAG,CAI/D,IAAMC,EAAUC,EAAsBJ,CAAG,EACnCP,EAAO,MAAMY,EAAuBL,EAAKhC,EAAOP,EAASG,EAAeD,CAAU,EACxF,OAAA2C,EAAoBb,EAAK,KAAMQ,GAAU,OAAO,KAAK7C,EAAI,aAAa,SAASuC,CAAS,EAAE,MAAM,CAAC,EACjGI,EAAQ,MAAMQ,EAAgBP,EAAKP,EAAK,KAAMM,EAAOI,EAAQ,IAAI,EAE1DL,EAAa,CAAE,GAAGI,EAAU,MAAAH,EAAO,IAAAC,EAAK,OAAAC,CAAO,CAAC,CAC3D,EACA,MAAM,KAAKO,EAAc,CAAE,MAAAC,EAAO,IAAAT,EAAK,OAAAC,EAAQ,GAAGC,CAAS,EAAG,CAI1D,IAAMC,EAAUC,EAAsBJ,CAAG,EACnCP,EAAO,MAAMY,EAAuBL,EAAKhC,EAAOP,EAASG,EAAeD,CAAU,EAExF,GAAI,CAAC8B,EAAK,KACN,MAAM,IAAIiB,EAKd,GAHAJ,EAAoBb,EAAK,KAAMQ,CAAM,EACrCU,EAAyBlB,EAAK,KAAMgB,CAAK,EAErChB,EAAK,SACL,QAAWT,KAAO,OAAO,KAAKS,EAAK,QAAQ,EAAG,CAC1C,IAAMmB,EAAWnB,EAAK,SAAST,CAAG,EAC9B,OAAO4B,GAAa,WACpBH,EAAMzB,CAAG,EAAI,MAAM4B,EAAS,CAAE,KAAMT,EAAQ,KAAM,IAAAH,EAAK,MAAAS,CAAM,CAAC,EAE9DA,EAAMzB,CAAG,EAAImB,EAAQ,KAAKS,CAAQ,CAE1C,CAGJ,IAAMC,EAAoBJ,EAAMb,EAAK,UAAU,IAAM,OAC/CkB,EAAkB,CAAC,EAGzB,GAFAA,EAAgBlB,EAAK,UAAU,EAAI,CAAE,GAAIa,EAAMb,EAAK,UAAU,CAAE,EAE5DiB,EAAmB,CACnB,IAAMd,EAAQ,MAAMQ,EAAgBP,EAAKP,EAAK,KAAMqB,EAAiBX,EAAQ,IAAI,EAQjF,IANc,MAAMP,EAAK,KAAK,CAC1B,MAAAG,EACA,IAAAC,EACA,OAAAC,CACJ,CAAC,GAES,SAAW,EACjB,MAAM,IAAIS,EAGd,OAAOF,EAAa,CAAE,MAAAC,EAAO,IAAAT,EAAK,OAAAC,EAAQ,GAAGC,CAAS,CAAC,CAC3D,CAEA,OAAOM,EAAa,CAAE,MAAAC,EAAO,IAAAT,EAAK,OAAAC,EAAQ,GAAGC,CAAS,CAAC,CAC3D,EAEA,MAAM,OAAOa,EAAgB,CAAE,OAAAC,EAAQ,IAAAhB,EAAK,OAAAC,EAAQ,GAAGC,CAAS,EAAG,CAI/D,IAAMC,EAAUC,EAAsBJ,CAAG,EACnCP,EAAO,MAAMY,EAAuBL,EAAKhC,EAAOP,EAASG,EAAeD,CAAU,EAExF,GAAI,CAAC8B,EAAK,KACN,MAAM,IAAIiB,EAOd,GAJAJ,EAAoBb,EAAK,KAAMQ,CAAM,EACrCU,EAAyBlB,EAAK,KAAMuB,CAAM,EAGtCvB,EAAK,SACL,QAAWgB,KAASO,EAChB,QAAWhC,KAAO,OAAO,KAAKS,EAAK,QAAQ,EAAG,CAC1C,IAAMmB,EAAWnB,EAAK,SAAST,CAAG,EAC9B,OAAO4B,GAAa,WACpBH,EAAMzB,CAAG,EAAI,MAAM4B,EAAS,CAAE,KAAMT,EAAQ,KAAM,IAAAH,EAAK,MAAAS,CAAM,CAAC,EAE9DA,EAAMzB,CAAG,EAAImB,EAAQ,KAAKS,CAAQ,CAE1C,CAIR,OAAOG,EAAe,CAAE,OAAAC,EAAQ,IAAAhB,EAAK,OAAAC,EAAQ,GAAGC,CAAS,CAAC,CAC9D,EAEA,MAAM,OAAOe,EAAgB,CAAE,MAAAlB,EAAO,IAAAC,EAAK,OAAAC,EAAQ,GAAGC,CAAS,EAAG,CAI9D,IAAMC,EAAUC,EAAsBJ,CAAG,EACnCP,EAAO,MAAMY,EAAuBL,EAAKhC,EAAOP,EAASG,EAAeD,CAAU,EAExF,OAAAoC,EAAQ,MAAMQ,EAAgBP,EAAKP,EAAK,OAAQM,EAAOI,EAAQ,IAAI,EAE5Dc,EAAe,CAAE,MAAAlB,EAAO,IAAAC,EAAK,OAAAC,EAAQ,GAAGC,CAAS,CAAC,CAC7D,EAEA,MAAM,WAAWgB,EAAoB,CAAE,MAAAnB,EAAO,IAAAC,EAAK,OAAAC,EAAQ,GAAGC,CAAS,EAAG,CAItE,IAAMC,EAAUC,EAAsBJ,CAAG,EACnCP,EAAO,MAAMY,EAAuBL,EAAKhC,EAAOP,EAASG,EAAeD,CAAU,EAExF,OAAAoC,EAAQ,MAAMQ,EAAgBP,EAAKP,EAAK,WAAYM,EAAOI,EAAQ,IAAI,EAEhEe,EAAmB,CAAE,GAAGhB,EAAU,MAAAH,EAAO,IAAAC,EAAK,OAAAC,CAAO,CAAC,CACjE,CACJ,CAAC,CACL,CACJ,CAAC,CACL,CAEA,eAAeM,EAAgBP,EAA0BP,EAAMM,EAAOoB,EAAM,CACxE,GAAI,CAAC1B,EACD,MAAM,IAAIiB,EAEd,IAAMP,EAAUC,EAAsBJ,CAAG,EAIzC,GAFAD,EAAQA,GAAS,CAAC,EAEd,OAAON,GAAS,SAAU,CAC1B,GAAM,CAAE,OAAA2B,CAAO,EAAI3B,EAGnB,GAAI2B,EACA,QAAWpC,KAAO,OAAO,KAAKoC,CAAM,EAAG,CACnC,IAAMC,EAAUD,EAAOpC,CAAG,EAC1B,GAAI,OAAOqC,GAAY,SAEnBtB,EAAMf,CAAG,EAAI,CACT,GAAImB,EAAQ,KAAKkB,CAAO,CAC5B,MAMA,SAAWC,KAAa,OAAO,KAAKD,CAAO,EAAG,CAC1C,IAAME,EAASF,EAAQC,CAAS,EAChCvB,EAAMf,CAAG,EAAI,CACT,CAACsC,CAAS,EAAGnB,EAAQ,KAAKoB,CAAM,CACpC,CACJ,CAER,CAER,MAAW,OAAO9B,GAAS,aACvBM,EAAQ,MAAMN,EAAK,CAAE,KAAA0B,EAAM,IAAAnB,EAAK,MAAAD,CAAM,CAAC,GAE3C,OAAOA,CACX,CAEA,eAAeM,EAAuBL,EAA0BhC,EAA2BP,EAAiBG,EAAuBD,EAAa,GAAO,CACnJ,IAAMwC,EAAUC,EAAsBJ,CAAG,EACzC,MAAMG,EAAQ,yBAAyB,EACvC,IAAMpC,EAAQyD,EAASrB,EAAS1C,EAASG,EAAeD,CAAU,EAC5D8B,EAAOgC,EAASzD,EAAOD,CAAK,EAClC,GAAI,CAAC0B,EACD,MAAAO,EAAI,MAAM,QAAQ,IAAI,KAAK,CAAE,MAAAjC,EAAO,MAAAC,CAAM,EAAG,mBAAmB,EAC1D,IAAI0C,EAEd,OAAAV,EAAI,MAAM,QAAQ,IAAI,MAAM,CAAE,MAAAjC,EAAO,KAAA0B,CAAK,EAAG,YAAY,EAClDA,CACX,CAEA,SAASa,EAAoBb,EAAMQ,EAAQ,CACvC,GAAI,CAACR,EACD,MAAM,IAAIiB,EAEd,GAAM,CAAE,OAAQgB,CAAe,EAAIjC,EAEnC,GAAIiC,GACA,QAAWC,KAAS1B,EAChB,GAAI,CAACyB,EAAe,SAASC,CAAK,EAC9B,MAAM,IAAIC,EAAkBD,CAAK,EAIjD,CAEA,IAAME,EAAiB,CAACb,EAAQU,IAAmB,CAC/C,QAAWjB,KAASO,EAAQ,CACxB,IAAMc,EAAc,OAAO,KAAKrB,CAAK,EACrC,QAAWsB,KAAcD,EACrB,GAAI,CAACJ,EAAe,SAASK,CAAU,EACnC,MAAM,IAAIH,EAAkBG,CAAU,CAGlD,CACJ,EAEA,SAASpB,EAAyBlB,EAAMuB,EAAQ,CAC5C,GAAM,CAAE,OAAQU,CAAe,EAAIjC,EAE/BiC,IACK,MAAM,QAAQV,CAAM,EAKrBa,EAAeb,EAAQU,CAAc,EAHrCG,EAAe,CAACb,CAAM,EAAGU,CAAc,EAMnD,CAEA,SAAS7B,GAAgCD,EAAc5B,EAAO,CAE1D,IAAMgE,EACF,OAAO,OAAOpC,EAAK,MAAM,EACpB,OAAOqC,GAAM,CAACA,EAAE,YAAc,CAACA,EAAE,UAAW,EAC5C,IAAI,CAAC,CAAE,UAAAC,CAAU,IAAOA,CAAU,EAE3C,QAAWzC,KAAQzB,EAAO,CACtB,GAAM,CAAE,OAAAO,EAAQ,KAAA4D,CAAK,EAAI1C,EACzB,GAAI0C,GAAQA,EAAK,OAAQ,CACrB,IAAMlC,EAASkC,EAAK,OACpB,QAAWC,KAAUJ,EACjB,GAAI,CAAC/B,EAAO,SAASmC,CAAM,EACvB,MAAM,IAAIC,EAAwBD,EAAQ7D,CAAM,CAG5D,CACJ,CACJ,CAEA,IAAO+D,MAAQ,EAAAC,SAAGpF,EAAI","names":["index_exports","__export","index_default","__toCommonJS","import_fastify_plugin","import_leven","fastifyUser","findRule","rules","roles","found","rule","role","find_rule_default","getRequestFromContext","ctx","getRoles","request","roleKey","anonymousRole","isRolePath","output","user","rolesRaw","roleKeys","key","import_error","ERROR_PREFIX","Unauthorized","createError","UnauthorizedField","MissingNotNullableError","import_fastify_logto","PLT_ADMIN_ROLE","auth","app","opts","fastifyLogto","fastifyUser","adminSecret","roleKey","userKey","isRolePath","anonymousRole","composeLogToRules","rolesResp","roles","rules","role","scopesResp","scopes","scope","roleName","scopeAction","entity","nearest","findNearestEntity","checkExists","r","newRule","setupUser","forceAdminRole","target","key","value","newKey","ruleEntity","acc","distance","leven","entityRules","i","rule","ruleEntities","entityKey","type","checkSaveMandatoryFieldsInRules","originalFind","where","ctx","fields","restOpts","request","getRequestFromContext","findRuleForRequestUser","checkFieldsFromRule","fromRuleToWhere","originalSave","input","Unauthorized","checkInputFromRuleFields","defaults","hasAllPrimaryKeys","whereConditions","originalInsert","inputs","originalDelete","originalUpdateMany","user","checks","clauses","clauseKey","clause","getRoles","find_rule_default","fieldsFromRule","field","UnauthorizedField","validateInputs","inputFields","inputField","mandatoryFields","k","camelcase","save","mField","MissingNotNullableError","index_default","fp"]}

package/lib/index.d.cts

@@ -0,0 +1,32 @@
+import { FastifyInstance } from 'fastify';
+import { FastifyUserPluginOptions } from 'fastify-user';
+
+type PlatformaticRule = {
+    role: string;
+    entity?: string;
+    entities?: string[];
+    defaults?: Record<string, string>;
+    checks?: boolean;
+    find?: boolean;
+    save?: boolean;
+    delete?: boolean;
+};
+type PlatformaticLogtoAuthOptions = {
+    logtoBaseUrl?: string;
+    logtoAppId?: string;
+    logtoAppSecret?: string;
+    adminSecret?: string;
+    rolePath?: string;
+    roleKey?: string;
+    userPath?: string;
+    userKey?: string;
+    anonymousRole?: string;
+    allowAnonymous?: boolean;
+    checks?: boolean;
+    defaults?: boolean;
+    jwtPlugin: FastifyUserPluginOptions;
+};
+declare function auth(app: FastifyInstance, opts: PlatformaticLogtoAuthOptions): Promise<void>;
+declare const _default: typeof auth;
+
+export { type PlatformaticLogtoAuthOptions, type PlatformaticRule, _default as default };

package/lib/index.d.ts

@@ -1,6 +1,7 @@
 import { FastifyInstance } from 'fastify';
-import type { FastifyUserPluginOptions } from 'fastify-user';
-export type PlatformaticRule = {
+import { FastifyUserPluginOptions } from 'fastify-user';
+
+type PlatformaticRule = {
     role: string;
     entity?: string;
     entities?: string[];
@@ -10,7 +11,7 @@ export type PlatformaticRule = {
     save?: boolean;
     delete?: boolean;
 };
-export type PlatformaticLogtoAuthOptions = {
+type PlatformaticLogtoAuthOptions = {
     logtoBaseUrl?: string;
     logtoAppId?: string;
     logtoAppSecret?: string;
@@ -27,4 +28,5 @@ export type PlatformaticLogtoAuthOptions = {
 };
 declare function auth(app: FastifyInstance, opts: PlatformaticLogtoAuthOptions): Promise<void>;
 declare const _default: typeof auth;
-export default _default;
+
+export { type PlatformaticLogtoAuthOptions, type PlatformaticRule, _default as default };

package/lib/index.js

@@ -1,420 +1,2 @@
-import fp from 'fastify-plugin';
-import leven from 'leven';
-import fastifyUser from 'fastify-user';
-import findRule from './utils/find-rule.js';
-import { getRequestFromContext, getRoles } from './utils/utils.js';
-import { Unauthorized, UnauthorizedField, MissingNotNullableError } from './utils/errors.js';
-import fastifyLogto from '@albirex/fastify-logto';
-const PLT_ADMIN_ROLE = 'platformatic-admin';
-async function auth(app, opts) {
-    app.register(fastifyLogto, {
-        endpoint: opts.logtoBaseUrl || 'https://auth.example.com',
-        appId: opts.logtoAppId || 'your-app-id',
-        appSecret: opts.logtoAppSecret || 'your-app-secret',
-    });
-    await app.register(fastifyUser.default, opts.jwtPlugin);
-    const adminSecret = opts.adminSecret;
-    const roleKey = opts.rolePath || opts.roleKey || 'X-PLATFORMATIC-ROLE';
-    const userKey = opts.userPath || opts.userKey || 'X-PLATFORMATIC-USER-ID';
-    const isRolePath = !!opts.rolePath; // if `true` the role is intepreted as path like `user.role`
-    const anonymousRole = opts.anonymousRole || 'anonymous';
-    async function composeLogToRules() {
-        const rolesResp = await app.logto.callAPI('/api/roles?type=User', 'GET');
-        if (!rolesResp.ok) {
-            throw rolesResp;
-        }
-        const roles = await rolesResp.json();
-        const rules = [{
-                role: anonymousRole,
-                entities: Object.keys(app.platformatic.entities),
-                find: opts.allowAnonymous,
-                save: opts.allowAnonymous,
-                delete: opts.allowAnonymous,
-            }];
-        for (const role of roles) {
-            const scopesResp = await app.logto.callAPI(`/api/roles/${role.id}/scopes`, 'GET');
-            if (!scopesResp.ok) {
-                throw scopesResp;
-            }
-            const scopes = await scopesResp.json();
-            for (const scope of scopes) {
-                const roleName = role.name;
-                const [scopeAction, entity] = scope.name.split(':');
-                if (!app.platformatic.entities[entity]) {
-                    const nearest = findNearestEntity(entity);
-                    app.log.warn(`Unknown entity '${entity}' in authorization rule. Did you mean '${nearest.entity}'?`);
-                    continue;
-                }
-                const checkExists = rules.find(r => r.role === roleName && r.entity === entity);
-                if (checkExists) {
-                    if (opts.checks) {
-                        checkExists[scopeAction] = {
-                            checks: {
-                                userId: userKey
-                            }
-                        };
-                    }
-                    else {
-                        checkExists[scopeAction] = true;
-                    }
-                }
-                else {
-                    const newRule = {
-                        role: roleName,
-                        entity,
-                    };
-                    if (opts.checks) {
-                        newRule[scopeAction] = {
-                            checks: {
-                                userId: userKey
-                            }
-                        };
-                    }
-                    else {
-                        newRule[scopeAction] = true;
-                    }
-                    if (opts.defaults) {
-                        newRule.defaults = {
-                            userId: userKey
-                        };
-                    }
-                    rules.push(newRule);
-                }
-            }
-        }
-        app.log.debug('LogTo calculated rules');
-        app.log.debug(rules);
-        return rules;
-    }
-    app.decorateRequest('setupDBAuthorizationUser', setupUser);
-    async function setupUser() {
-        // if (!adminSecret) {
-        await this.extractUser();
-        // }
-        let forceAdminRole = false;
-        if (adminSecret && this.headers['x-platformatic-admin-secret'] === adminSecret) {
-            if (opts.jwtPlugin.jwt) {
-                forceAdminRole = true;
-            }
-            else {
-                this.log.info('admin secret is valid');
-                this.user = new Proxy(this.headers, {
-                    get: (target, key) => {
-                        let value;
-                        if (!target[key.toString()]) {
-                            const newKey = key.toString().toLowerCase();
-                            value = target[newKey];
-                        }
-                        else {
-                            value = target[key.toString()];
-                        }
-                        if (!value && key.toString().toLowerCase() === roleKey.toLowerCase()) {
-                            value = PLT_ADMIN_ROLE;
-                        }
-                        return value;
-                    },
-                });
-            }
-        }
-        if (forceAdminRole) {
-            // We replace just the role in `request.user`, all the rest is untouched
-            this.user = {
-                // ...request.user,
-                [roleKey]: PLT_ADMIN_ROLE,
-            };
-        }
-    }
-    function findNearestEntity(ruleEntity) {
-        // There is an unknown entity. Let's find out the nearest one for a nice error message
-        const entities = Object.keys(app.platformatic.entities);
-        const nearest = entities.reduce((acc, entity) => {
-            const distance = leven(ruleEntity, entity);
-            if (distance < acc.distance) {
-                acc.distance = distance;
-                acc.entity = entity;
-            }
-            return acc;
-        }, { distance: Infinity, entity: null });
-        return nearest;
-    }
-    app.addHook('onReady', async function () {
-        const rules = await composeLogToRules();
-        // TODO validate that there is at most a rule for a given role
-        const entityRules = {};
-        for (let i = 0; i < rules.length; i++) {
-            const rule = rules[i];
-            let ruleEntities = null;
-            if (rule.entity) {
-                ruleEntities = [rule.entity];
-            }
-            else if (rule.entities) {
-                ruleEntities = [...rule.entities];
-            }
-            else {
-                throw new Error(`Missing entity in authorization rule ${i}`);
-            }
-            for (const ruleEntity of ruleEntities) {
-                const newRule = { ...rule, entity: ruleEntity, entities: undefined };
-                if (!app.platformatic.entities[newRule.entity]) {
-                    const nearest = findNearestEntity(ruleEntity);
-                    throw new Error(`Unknown entity '${ruleEntity}' in authorization rule ${i}. Did you mean '${nearest.entity}'?`);
-                }
-                if (!entityRules[ruleEntity]) {
-                    entityRules[ruleEntity] = [];
-                }
-                entityRules[ruleEntity].push(newRule);
-            }
-        }
-        for (const entityKey of Object.keys(app.platformatic.entities)) {
-            const rules = entityRules[entityKey] || [];
-            const type = app.platformatic.entities[entityKey];
-            // We have subscriptions!
-            let userPropToFillForPublish;
-            const topicsWithoutChecks = false;
-            // mqtt
-            // if (app.platformatic.mq) {
-            //     for (const rule of rules) {
-            //         const checks = rule.find?.checks
-            //         if (typeof checks !== 'object') {
-            //             topicsWithoutChecks = !!rule.find
-            //             continue
-            //         }
-            //         const keys = Object.keys(checks)
-            //         if (keys.length !== 1) {
-            //             throw new Error(`Subscription requires that the role "${rule.role}" has only one check in the find rule for entity "${rule.entity}"`)
-            //         }
-            //         const key = keys[0]
-            //         const val = typeof checks[key] === 'object' ? checks[key].eq : checks[key]
-            //         if (userPropToFillForPublish && userPropToFillForPublish.val !== val) {
-            //             throw new Error('Unable to configure subscriptions and authorization due to multiple check clauses in find')
-            //         }
-            //         userPropToFillForPublish = { key, val }
-            //     }
-            // }
-            if (userPropToFillForPublish && topicsWithoutChecks) {
-                throw new Error(`Subscription for entity "${entityKey}" have conflictling rules across roles`);
-            }
-            // MUST set this after doing the security checks on the subscriptions
-            if (adminSecret) {
-                rules.push({
-                    role: PLT_ADMIN_ROLE,
-                    find: true,
-                    save: true,
-                    delete: true,
-                });
-            }
-            // If we have `fields` in save rules, we need to check if all the not-nullable
-            // fields are specified
-            checkSaveMandatoryFieldsInRules(type, rules);
-            // function useOriginal(skipAuth: boolean, ctx: PlatformaticContext) {
-            //     if (skipAuth === false && !ctx) {
-            //         throw new Error('Cannot set skipAuth to `false` without ctx')
-            //     }
-            //     return skipAuth || !ctx
-            // }
-            app.platformatic.addEntityHooks(entityKey, {
-                async find(originalFind, { where, ctx, fields, ...restOpts } = {}) {
-                    // if (useOriginal(skipAuth, ctx)) {
-                    //     return originalFind({ ...restOpts, where, ctx, fields })
-                    // }
-                    const request = getRequestFromContext(ctx);
-                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath);
-                    checkFieldsFromRule(rule.find, fields || Object.keys(app.platformatic.entities[entityKey].fields));
-                    where = await fromRuleToWhere(ctx, rule.find, where, request.user);
-                    return originalFind({ ...restOpts, where, ctx, fields });
-                },
-                async save(originalSave, { input, ctx, fields, ...restOpts }) {
-                    // if (useOriginal(skipAuth, ctx)) {
-                    //     return originalSave({ ctx, input, fields, ...restOpts })
-                    // }
-                    const request = getRequestFromContext(ctx);
-                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath);
-                    if (!rule.save) {
-                        throw new Unauthorized();
-                    }
-                    checkFieldsFromRule(rule.save, fields);
-                    checkInputFromRuleFields(rule.save, input);
-                    if (rule.defaults) {
-                        for (const key of Object.keys(rule.defaults)) {
-                            const defaults = rule.defaults[key];
-                            if (typeof defaults === 'function') {
-                                input[key] = await defaults({ user: request.user, ctx, input });
-                            }
-                            else {
-                                input[key] = request.user[defaults];
-                            }
-                        }
-                    }
-                    const hasAllPrimaryKeys = input[type.primaryKey] !== undefined;
-                    const whereConditions = {};
-                    whereConditions[type.primaryKey] = { eq: input[type.primaryKey] };
-                    if (hasAllPrimaryKeys) {
-                        const where = await fromRuleToWhere(ctx, rule.save, whereConditions, request.user);
-                        const found = await type.find({
-                            where,
-                            ctx,
-                            fields,
-                        });
-                        if (found.length === 0) {
-                            throw new Unauthorized();
-                        }
-                        return originalSave({ input, ctx, fields, ...restOpts });
-                    }
-                    return originalSave({ input, ctx, fields, ...restOpts });
-                },
-                async insert(originalInsert, { inputs, ctx, fields, ...restOpts }) {
-                    // if (useOriginal(skipAuth, ctx)) {
-                    //     return originalInsert({ inputs, ctx, fields, ...restOpts })
-                    // }
-                    const request = getRequestFromContext(ctx);
-                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath);
-                    if (!rule.save) {
-                        throw new Unauthorized();
-                    }
-                    checkFieldsFromRule(rule.save, fields);
-                    checkInputFromRuleFields(rule.save, inputs);
-                    /* istanbul ignore else */
-                    if (rule.defaults) {
-                        for (const input of inputs) {
-                            for (const key of Object.keys(rule.defaults)) {
-                                const defaults = rule.defaults[key];
-                                if (typeof defaults === 'function') {
-                                    input[key] = await defaults({ user: request.user, ctx, input });
-                                }
-                                else {
-                                    input[key] = request.user[defaults];
-                                }
-                            }
-                        }
-                    }
-                    return originalInsert({ inputs, ctx, fields, ...restOpts });
-                },
-                async delete(originalDelete, { where, ctx, fields, ...restOpts }) {
-                    // if (useOriginal(skipAuth, ctx)) {
-                    //     return originalDelete({ where, ctx, fields, ...restOpts })
-                    // }
-                    const request = getRequestFromContext(ctx);
-                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath);
-                    where = await fromRuleToWhere(ctx, rule.delete, where, request.user);
-                    return originalDelete({ where, ctx, fields, ...restOpts });
-                },
-                async updateMany(originalUpdateMany, { where, ctx, fields, ...restOpts }) {
-                    // if (useOriginal(skipAuth, ctx)) {
-                    //     return originalUpdateMany({ ...restOpts, where, ctx, fields })
-                    // }
-                    const request = getRequestFromContext(ctx);
-                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath);
-                    where = await fromRuleToWhere(ctx, rule.updateMany, where, request.user);
-                    return originalUpdateMany({ ...restOpts, where, ctx, fields });
-                },
-            });
-        }
-    });
-}
-async function fromRuleToWhere(ctx, rule, where, user) {
-    if (!rule) {
-        throw new Unauthorized();
-    }
-    const request = getRequestFromContext(ctx);
-    /* istanbul ignore next */
-    where = where || {};
-    if (typeof rule === 'object') {
-        const { checks } = rule;
-        /* istanbul ignore else */
-        if (checks) {
-            for (const key of Object.keys(checks)) {
-                const clauses = checks[key];
-                if (typeof clauses === 'string') {
-                    // case: "userId": "X-PLATFORMATIC-USER-ID"
-                    where[key] = {
-                        eq: request.user[clauses],
-                    };
-                }
-                else {
-                    // case:
-                    // userId: {
-                    //   eq: 'X-PLATFORMATIC-USER-ID'
-                    // }
-                    for (const clauseKey of Object.keys(clauses)) {
-                        const clause = clauses[clauseKey];
-                        where[key] = {
-                            [clauseKey]: request.user[clause],
-                        };
-                    }
-                }
-            }
-        }
-    }
-    else if (typeof rule === 'function') {
-        where = await rule({ user, ctx, where });
-    }
-    return where;
-}
-async function findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath = false) {
-    const request = getRequestFromContext(ctx);
-    await request.setupDBAuthorizationUser();
-    const roles = getRoles(request, roleKey, anonymousRole, isRolePath);
-    const rule = findRule(rules, roles);
-    if (!rule) {
-        ctx.reply.request.log.warn({ roles, rules }, 'no rule for roles');
-        throw new Unauthorized();
-    }
-    ctx.reply.request.log.trace({ roles, rule }, 'found rule');
-    return rule;
-}
-function checkFieldsFromRule(rule, fields) {
-    if (!rule) {
-        throw new Unauthorized();
-    }
-    const { fields: fieldsFromRule } = rule;
-    /* istanbul ignore else */
-    if (fieldsFromRule) {
-        for (const field of fields) {
-            if (!fieldsFromRule.includes(field)) {
-                throw new UnauthorizedField(field);
-            }
-        }
-    }
-}
-const validateInputs = (inputs, fieldsFromRule) => {
-    for (const input of inputs) {
-        const inputFields = Object.keys(input);
-        for (const inputField of inputFields) {
-            if (!fieldsFromRule.includes(inputField)) {
-                throw new UnauthorizedField(inputField);
-            }
-        }
-    }
-};
-function checkInputFromRuleFields(rule, inputs) {
-    const { fields: fieldsFromRule } = rule;
-    /* istanbul ignore else */
-    if (fieldsFromRule) {
-        if (!Array.isArray(inputs)) {
-            // save
-            validateInputs([inputs], fieldsFromRule);
-        }
-        else {
-            // insert
-            validateInputs(inputs, fieldsFromRule);
-        }
-    }
-}
-function checkSaveMandatoryFieldsInRules(type, rules) {
-    // List of not nullable, not PKs field to validate save/insert when allowed fields are specified on the rule
-    const mandatoryFields = Object.values(type.fields)
-        .filter(k => (!k.isNullable && !k.primaryKey))
-        .map(({ camelcase }) => (camelcase));
-    for (const rule of rules) {
-        const { entity, save } = rule;
-        if (save && save.fields) {
-            const fields = save.fields;
-            for (const mField of mandatoryFields) {
-                if (!fields.includes(mField)) {
-                    throw new MissingNotNullableError(mField, entity);
-                }
-            }
-        }
-    }
-}
-export default fp(auth);
+import B from"fastify-plugin";import H from"leven";import*as G from"fastify-user";function z(t,e){let s=null;for(let r of t){for(let a of e)if(r.role===a){s=r;break}if(s)break}return s}var N=z;function A(t){if(t&&!t.reply)throw new Error("Missing reply in context. You should call this function with { ctx: { reply }}");return t.reply.request}function M(t,e,s,r=!1){let a=[],c=t.user;if(!c)return a.push(s),a;let l;if(r){let h=e.split(".");l=c;for(let F of h)l=l[F]}else l=c[e];return typeof l=="string"?a=l.split(","):Array.isArray(l)&&(a=l),a.length===0&&a.push(s),a}import q from"@fastify/error";var T="PLT_DB_AUTH",b=q(`${T}_UNAUTHORIZED`,"operation not allowed",401),K=q(`${T}_FIELD_UNAUTHORIZED`,"field not allowed: %s",401),_=q(`${T}_NOT_NULLABLE_MISSING`,'missing not nullable field: "%s" in save rule for entity "%s"');import W from"@albirex/fastify-logto";var S="platformatic-admin";async function X(t,e){t.register(W,{endpoint:e.logtoBaseUrl||"https://auth.example.com",appId:e.logtoAppId||"your-app-id",appSecret:e.logtoAppSecret||"your-app-secret"}),await t.register(G,e.jwtPlugin);let s=e.adminSecret,r=e.rolePath||e.roleKey||"X-PLATFORMATIC-ROLE",a=e.userPath||e.userKey||"X-PLATFORMATIC-USER-ID",c=!!e.rolePath,l=e.anonymousRole||"anonymous";async function h(){let R=await t.logto.callAPI("/api/roles?type=User","GET");if(!R.ok)throw R;let P=await R.json(),f=[{role:l,entities:Object.keys(t.platformatic.entities),find:e.allowAnonymous,save:e.allowAnonymous,delete:e.allowAnonymous}];for(let i of P){let d=await t.logto.callAPI(`/api/roles/${i.id}/scopes`,"GET");if(!d.ok)throw d;let w=await d.json();for(let I of w){let g=i.name,[n,o]=I.name.split(":");if(!t.platformatic.entities[o]){let y=v(o);t.log.warn(`Unknown entity '${o}' in authorization rule. Did you mean '${y.entity}'?`);continue}let m=f.find(y=>y.role===g&&y.entity===o);if(m)e.checks?m[n]={checks:{userId:a}}:m[n]=!0;else{let y={role:g,entity:o};e.checks?y[n]={checks:{userId:a}}:y[n]=!0,e.defaults&&(y.defaults={userId:a}),f.push(y)}}}return t.log.debug("LogTo calculated rules"),t.log.debug(f),f}t.decorateRequest("setupDBAuthorizationUser",F);async function F(){await this.extractUser();let R=!1;s&&this.headers["x-platformatic-admin-secret"]===s&&(e.jwtPlugin.jwt?R=!0:(this.log.info("admin secret is valid"),this.user=new Proxy(this.headers,{get:(P,f)=>{let i;if(P[f.toString()])i=P[f.toString()];else{let d=f.toString().toLowerCase();i=P[d]}return!i&&f.toString().toLowerCase()===r.toLowerCase()&&(i=S),i}}))),R&&(this.user={[r]:S})}function v(R){return Object.keys(t.platformatic.entities).reduce((i,d)=>{let w=H(R,d);return w<i.distance&&(i.distance=w,i.entity=d),i},{distance:1/0,entity:null})}t.addHook("onReady",async function(){let R=await h(),P={};for(let f=0;f<R.length;f++){let i=R[f],d=null;if(i.entity)d=[i.entity];else if(i.entities)d=[...i.entities];else throw new Error(`Missing entity in authorization rule ${f}`);for(let w of d){let I={...i,entity:w,entities:void 0};if(!t.platformatic.entities[I.entity]){let g=v(w);throw new Error(`Unknown entity '${w}' in authorization rule ${f}. Did you mean '${g.entity}'?`)}P[w]||(P[w]=[]),P[w].push(I)}}for(let f of Object.keys(t.platformatic.entities)){let i=P[f]||[],d=t.platformatic.entities[f];if(void 0&&!1)throw new Error(`Subscription for entity "${f}" have conflictling rules across roles`);s&&i.push({role:S,find:!0,save:!0,delete:!0}),Z(d,i),t.platformatic.addEntityHooks(f,{async find(g,{where:n,ctx:o,fields:m,...y}={}){let p=A(o),u=await O(o,i,r,l,c);return C(u.find,m||Object.keys(t.platformatic.entities[f].fields)),n=await j(o,u.find,n,p.user),g({...y,where:n,ctx:o,fields:m})},async save(g,{input:n,ctx:o,fields:m,...y}){let p=A(o),u=await O(o,i,r,l,c);if(!u.save)throw new b;if(C(u.save,m),D(u.save,n),u.defaults)for(let k of Object.keys(u.defaults)){let L=u.defaults[k];typeof L=="function"?n[k]=await L({user:p.user,ctx:o,input:n}):n[k]=p.user[L]}let U=n[d.primaryKey]!==void 0,E={};if(E[d.primaryKey]={eq:n[d.primaryKey]},U){let k=await j(o,u.save,E,p.user);if((await d.find({where:k,ctx:o,fields:m})).length===0)throw new b;return g({input:n,ctx:o,fields:m,...y})}return g({input:n,ctx:o,fields:m,...y})},async insert(g,{inputs:n,ctx:o,fields:m,...y}){let p=A(o),u=await O(o,i,r,l,c);if(!u.save)throw new b;if(C(u.save,m),D(u.save,n),u.defaults)for(let U of n)for(let E of Object.keys(u.defaults)){let k=u.defaults[E];typeof k=="function"?U[E]=await k({user:p.user,ctx:o,input:U}):U[E]=p.user[k]}return g({inputs:n,ctx:o,fields:m,...y})},async delete(g,{where:n,ctx:o,fields:m,...y}){let p=A(o),u=await O(o,i,r,l,c);return n=await j(o,u.delete,n,p.user),g({where:n,ctx:o,fields:m,...y})},async updateMany(g,{where:n,ctx:o,fields:m,...y}){let p=A(o),u=await O(o,i,r,l,c);return n=await j(o,u.updateMany,n,p.user),g({...y,where:n,ctx:o,fields:m})}})}})}async function j(t,e,s,r){if(!e)throw new b;let a=A(t);if(s=s||{},typeof e=="object"){let{checks:c}=e;if(c)for(let l of Object.keys(c)){let h=c[l];if(typeof h=="string")s[l]={eq:a.user[h]};else for(let F of Object.keys(h)){let v=h[F];s[l]={[F]:a.user[v]}}}}else typeof e=="function"&&(s=await e({user:r,ctx:t,where:s}));return s}async function O(t,e,s,r,a=!1){let c=A(t);await c.setupDBAuthorizationUser();let l=M(c,s,r,a),h=N(e,l);if(!h)throw t.reply.request.log.warn({roles:l,rules:e},"no rule for roles"),new b;return t.reply.request.log.trace({roles:l,rule:h},"found rule"),h}function C(t,e){if(!t)throw new b;let{fields:s}=t;if(s){for(let r of e)if(!s.includes(r))throw new K(r)}}var $=(t,e)=>{for(let s of t){let r=Object.keys(s);for(let a of r)if(!e.includes(a))throw new K(a)}};function D(t,e){let{fields:s}=t;s&&(Array.isArray(e)?$(e,s):$([e],s))}function Z(t,e){let s=Object.values(t.fields).filter(r=>!r.isNullable&&!r.primaryKey).map(({camelcase:r})=>r);for(let r of e){let{entity:a,save:c}=r;if(c&&c.fields){let l=c.fields;for(let h of s)if(!l.includes(h))throw new _(h,a)}}}var re=B(X);export{re as default};
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/utils/find-rule.ts","../src/utils/utils.ts","../src/utils/errors.ts"],"sourcesContent":["import fp from 'fastify-plugin'\nimport leven from 'leven'\nimport * as fastifyUser from 'fastify-user'\n\nimport findRule from './utils/find-rule.js'\nimport { getRequestFromContext, getRoles } from './utils/utils.js'\nimport { Unauthorized, UnauthorizedField, MissingNotNullableError } from './utils/errors.js'\nimport fastifyLogto from '@albirex/fastify-logto';\nimport { FastifyInstance } from 'fastify'\nimport type { FastifyUserPluginOptions } from 'fastify-user';\nimport type { Entity, PlatformaticContext } from '@platformatic/sql-mapper'\n\nconst PLT_ADMIN_ROLE = 'platformatic-admin'\n\nexport type PlatformaticRule = {\n    role: string;\n    entity?: string;\n    entities?: string[];\n    defaults?: Record<string, string>;\n    checks?: boolean;\n    find?: boolean;\n    save?: boolean;\n    delete?: boolean;\n\n};\n\nexport type PlatformaticLogtoAuthOptions = {\n    logtoBaseUrl?: string;\n    logtoAppId?: string;\n    logtoAppSecret?: string;\n    adminSecret?: string;\n    rolePath?: string;\n    roleKey?: string;\n    userPath?: string;\n    userKey?: string;\n    anonymousRole?: string;\n    allowAnonymous?: boolean;\n    checks?: boolean;\n    defaults?: boolean;\n    jwtPlugin: FastifyUserPluginOptions\n};\n\nasync function auth(app: FastifyInstance, opts: PlatformaticLogtoAuthOptions) {\n    app.register(fastifyLogto, {\n        endpoint: opts.logtoBaseUrl || 'https://auth.example.com',\n        appId: opts.logtoAppId || 'your-app-id',\n        appSecret: opts.logtoAppSecret || 'your-app-secret',\n    });\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    await app.register(fastifyUser as any, opts.jwtPlugin);\n\n    const adminSecret = opts.adminSecret\n    const roleKey = opts.rolePath || opts.roleKey || 'X-PLATFORMATIC-ROLE'\n    const userKey = opts.userPath || opts.userKey || 'X-PLATFORMATIC-USER-ID'\n    const isRolePath = !!opts.rolePath // if `true` the role is intepreted as path like `user.role`\n    const anonymousRole = opts.anonymousRole || 'anonymous'\n\n    async function composeLogToRules() {\n        const rolesResp = await app.logto.callAPI('/api/roles?type=User', 'GET');\n\n        if (!rolesResp.ok) {\n            throw rolesResp;\n        }\n\n        const roles = await rolesResp.json();\n        const rules: PlatformaticRule[] = [{\n            role: anonymousRole,\n            entities: Object.keys(app.platformatic.entities),\n            find: opts.allowAnonymous,\n            save: opts.allowAnonymous,\n            delete: opts.allowAnonymous,\n        }];\n\n        for (const role of roles) {\n            const scopesResp = await app.logto.callAPI(`/api/roles/${role.id}/scopes`, 'GET');\n\n            if (!scopesResp.ok) {\n                throw scopesResp;\n            }\n\n            const scopes = await scopesResp.json();\n\n            for (const scope of scopes) {\n                const roleName = role.name;\n                const [scopeAction, entity] = scope.name.split(':');\n\n                if (!app.platformatic.entities[entity]) {\n                    const nearest = findNearestEntity(entity)\n                    app.log.warn(`Unknown entity '${entity}' in authorization rule. Did you mean '${nearest.entity}'?`)\n                    continue;\n                }\n\n                const checkExists = rules.find(r => r.role === roleName && r.entity === entity);\n                if (checkExists) {\n                    if (opts.checks) {\n                        checkExists[scopeAction] = {\n                            checks: {\n                                userId: userKey\n                            }\n                        };\n                    } else {\n                        checkExists[scopeAction] = true;\n                    }\n                } else {\n                    const newRule: PlatformaticRule = {\n                        role: roleName,\n                        entity,\n                    };\n\n                    if (opts.checks) {\n                        newRule[scopeAction] = {\n                            checks: {\n                                userId: userKey\n                            }\n                        };\n                    } else {\n                        newRule[scopeAction] = true;\n                    }\n\n                    if (opts.defaults) {\n                        newRule.defaults = {\n                            userId: userKey\n                        };\n                    }\n\n                    rules.push(newRule);\n                }\n            }\n        }\n\n        app.log.debug('LogTo calculated rules');\n        app.log.debug(rules);\n        return rules;\n    }\n\n    app.decorateRequest('setupDBAuthorizationUser', setupUser)\n\n    async function setupUser() {\n        // if (!adminSecret) {\n        await this.extractUser()\n        // }\n\n        let forceAdminRole = false\n        if (adminSecret && this.headers['x-platformatic-admin-secret'] === adminSecret) {\n            if (opts.jwtPlugin.jwt) {\n                forceAdminRole = true\n            } else {\n                this.log.info('admin secret is valid')\n                this.user = new Proxy(this.headers, {\n                    get: (target, key) => {\n                        let value;\n                        if (!target[key.toString()]) {\n                            const newKey = key.toString().toLowerCase()\n                            value = target[newKey]\n                        } else {\n                            value = target[key.toString()]\n                        }\n\n                        if (!value && key.toString().toLowerCase() === roleKey.toLowerCase()) {\n                            value = PLT_ADMIN_ROLE\n                        }\n                        return value\n                    },\n                })\n            }\n        }\n\n        if (forceAdminRole) {\n            // We replace just the role in `request.user`, all the rest is untouched\n            this.user = {\n                // ...request.user,\n                [roleKey]: PLT_ADMIN_ROLE,\n            }\n        }\n    }\n\n    function findNearestEntity(ruleEntity) {\n        // There is an unknown entity. Let's find out the nearest one for a nice error message\n        const entities = Object.keys(app.platformatic.entities)\n\n        const nearest = entities.reduce((acc, entity) => {\n            const distance = leven(ruleEntity, entity)\n            if (distance < acc.distance) {\n                acc.distance = distance\n                acc.entity = entity\n            }\n            return acc\n        }, { distance: Infinity, entity: null })\n        return nearest\n    }\n\n    app.addHook('onReady', async function () {\n        const rules = await composeLogToRules();\n\n        // TODO validate that there is at most a rule for a given role\n        const entityRules = {};\n        for (let i = 0; i < rules.length; i++) {\n            const rule = rules[i]\n\n            let ruleEntities = null\n            if (rule.entity) {\n                ruleEntities = [rule.entity]\n            } else if (rule.entities) {\n                ruleEntities = [...rule.entities]\n            } else {\n                throw new Error(`Missing entity in authorization rule ${i}`)\n            }\n\n            for (const ruleEntity of ruleEntities) {\n                const newRule = { ...rule, entity: ruleEntity, entities: undefined }\n                if (!app.platformatic.entities[newRule.entity]) {\n                    const nearest = findNearestEntity(ruleEntity)\n                    throw new Error(`Unknown entity '${ruleEntity}' in authorization rule ${i}. Did you mean '${nearest.entity}'?`)\n                }\n\n                if (!entityRules[ruleEntity]) {\n                    entityRules[ruleEntity] = []\n                }\n                entityRules[ruleEntity].push(newRule)\n            }\n        }\n\n        for (const entityKey of Object.keys(app.platformatic.entities)) {\n            const rules = entityRules[entityKey] || []\n            const type = app.platformatic.entities[entityKey]\n\n            // We have subscriptions!\n            let userPropToFillForPublish\n            const topicsWithoutChecks = false\n\n            // mqtt\n            // if (app.platformatic.mq) {\n            //     for (const rule of rules) {\n            //         const checks = rule.find?.checks\n            //         if (typeof checks !== 'object') {\n            //             topicsWithoutChecks = !!rule.find\n            //             continue\n            //         }\n            //         const keys = Object.keys(checks)\n            //         if (keys.length !== 1) {\n            //             throw new Error(`Subscription requires that the role \"${rule.role}\" has only one check in the find rule for entity \"${rule.entity}\"`)\n            //         }\n            //         const key = keys[0]\n\n            //         const val = typeof checks[key] === 'object' ? checks[key].eq : checks[key]\n            //         if (userPropToFillForPublish && userPropToFillForPublish.val !== val) {\n            //             throw new Error('Unable to configure subscriptions and authorization due to multiple check clauses in find')\n            //         }\n            //         userPropToFillForPublish = { key, val }\n            //     }\n            // }\n\n            if (userPropToFillForPublish && topicsWithoutChecks) {\n                throw new Error(`Subscription for entity \"${entityKey}\" have conflictling rules across roles`)\n            }\n\n            // MUST set this after doing the security checks on the subscriptions\n            if (adminSecret) {\n                rules.push({\n                    role: PLT_ADMIN_ROLE,\n                    find: true,\n                    save: true,\n                    delete: true,\n                })\n            }\n\n            // If we have `fields` in save rules, we need to check if all the not-nullable\n            // fields are specified\n            checkSaveMandatoryFieldsInRules(type, rules)\n\n            // function useOriginal(skipAuth: boolean, ctx: PlatformaticContext) {\n            //     if (skipAuth === false && !ctx) {\n            //         throw new Error('Cannot set skipAuth to `false` without ctx')\n            //     }\n\n            //     return skipAuth || !ctx\n            // }\n\n            app.platformatic.addEntityHooks(entityKey, {\n                async find(originalFind, { where, ctx, fields, ...restOpts } = {}) {\n                    // if (useOriginal(skipAuth, ctx)) {\n                    //     return originalFind({ ...restOpts, where, ctx, fields })\n                    // }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n                    checkFieldsFromRule(rule.find, fields || Object.keys(app.platformatic.entities[entityKey].fields))\n                    where = await fromRuleToWhere(ctx, rule.find, where, request.user)\n\n                    return originalFind({ ...restOpts, where, ctx, fields })\n                },\n                async save(originalSave, { input, ctx, fields, ...restOpts }) {\n                    // if (useOriginal(skipAuth, ctx)) {\n                    //     return originalSave({ ctx, input, fields, ...restOpts })\n                    // }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n\n                    if (!rule.save) {\n                        throw new Unauthorized()\n                    }\n                    checkFieldsFromRule(rule.save, fields)\n                    checkInputFromRuleFields(rule.save, input)\n\n                    if (rule.defaults) {\n                        for (const key of Object.keys(rule.defaults)) {\n                            const defaults = rule.defaults[key]\n                            if (typeof defaults === 'function') {\n                                input[key] = await defaults({ user: request.user, ctx, input })\n                            } else {\n                                input[key] = request.user[defaults]\n                            }\n                        }\n                    }\n\n                    const hasAllPrimaryKeys = input[type.primaryKey] !== undefined;\n                    const whereConditions = {}\n                    whereConditions[type.primaryKey] = { eq: input[type.primaryKey] }\n\n                    if (hasAllPrimaryKeys) {\n                        const where = await fromRuleToWhere(ctx, rule.save, whereConditions, request.user)\n\n                        const found = await type.find({\n                            where,\n                            ctx,\n                            fields,\n                        })\n\n                        if (found.length === 0) {\n                            throw new Unauthorized()\n                        }\n\n                        return originalSave({ input, ctx, fields, ...restOpts })\n                    }\n\n                    return originalSave({ input, ctx, fields, ...restOpts })\n                },\n\n                async insert(originalInsert, { inputs, ctx, fields, ...restOpts }) {\n                    // if (useOriginal(skipAuth, ctx)) {\n                    //     return originalInsert({ inputs, ctx, fields, ...restOpts })\n                    // }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n\n                    if (!rule.save) {\n                        throw new Unauthorized()\n                    }\n\n                    checkFieldsFromRule(rule.save, fields)\n                    checkInputFromRuleFields(rule.save, inputs)\n\n                    /* istanbul ignore else */\n                    if (rule.defaults) {\n                        for (const input of inputs) {\n                            for (const key of Object.keys(rule.defaults)) {\n                                const defaults = rule.defaults[key]\n                                if (typeof defaults === 'function') {\n                                    input[key] = await defaults({ user: request.user, ctx, input })\n                                } else {\n                                    input[key] = request.user[defaults]\n                                }\n                            }\n                        }\n                    }\n\n                    return originalInsert({ inputs, ctx, fields, ...restOpts })\n                },\n\n                async delete(originalDelete, { where, ctx, fields, ...restOpts }) {\n                    // if (useOriginal(skipAuth, ctx)) {\n                    //     return originalDelete({ where, ctx, fields, ...restOpts })\n                    // }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n\n                    where = await fromRuleToWhere(ctx, rule.delete, where, request.user)\n\n                    return originalDelete({ where, ctx, fields, ...restOpts })\n                },\n\n                async updateMany(originalUpdateMany, { where, ctx, fields, ...restOpts }) {\n                    // if (useOriginal(skipAuth, ctx)) {\n                    //     return originalUpdateMany({ ...restOpts, where, ctx, fields })\n                    // }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n\n                    where = await fromRuleToWhere(ctx, rule.updateMany, where, request.user)\n\n                    return originalUpdateMany({ ...restOpts, where, ctx, fields })\n                },\n            })\n        }\n    })\n}\n\nasync function fromRuleToWhere(ctx: PlatformaticContext, rule, where, user) {\n    if (!rule) {\n        throw new Unauthorized()\n    }\n    const request = getRequestFromContext(ctx)\n    /* istanbul ignore next */\n    where = where || {}\n\n    if (typeof rule === 'object') {\n        const { checks } = rule\n\n        /* istanbul ignore else */\n        if (checks) {\n            for (const key of Object.keys(checks)) {\n                const clauses = checks[key]\n                if (typeof clauses === 'string') {\n                    // case: \"userId\": \"X-PLATFORMATIC-USER-ID\"\n                    where[key] = {\n                        eq: request.user[clauses],\n                    }\n                } else {\n                    // case:\n                    // userId: {\n                    //   eq: 'X-PLATFORMATIC-USER-ID'\n                    // }\n                    for (const clauseKey of Object.keys(clauses)) {\n                        const clause = clauses[clauseKey]\n                        where[key] = {\n                            [clauseKey]: request.user[clause],\n                        }\n                    }\n                }\n            }\n        }\n    } else if (typeof rule === 'function') {\n        where = await rule({ user, ctx, where })\n    }\n    return where\n}\n\nasync function findRuleForRequestUser(ctx: PlatformaticContext, rules: PlatformaticRule[], roleKey: string, anonymousRole: string, isRolePath = false) {\n    const request = getRequestFromContext(ctx)\n    await request.setupDBAuthorizationUser()\n    const roles = getRoles(request, roleKey, anonymousRole, isRolePath)\n    const rule = findRule(rules, roles)\n    if (!rule) {\n        ctx.reply.request.log.warn({ roles, rules }, 'no rule for roles')\n        throw new Unauthorized()\n    }\n    ctx.reply.request.log.trace({ roles, rule }, 'found rule')\n    return rule\n}\n\nfunction checkFieldsFromRule(rule, fields) {\n    if (!rule) {\n        throw new Unauthorized()\n    }\n    const { fields: fieldsFromRule } = rule\n    /* istanbul ignore else */\n    if (fieldsFromRule) {\n        for (const field of fields) {\n            if (!fieldsFromRule.includes(field)) {\n                throw new UnauthorizedField(field)\n            }\n        }\n    }\n}\n\nconst validateInputs = (inputs, fieldsFromRule) => {\n    for (const input of inputs) {\n        const inputFields = Object.keys(input)\n        for (const inputField of inputFields) {\n            if (!fieldsFromRule.includes(inputField)) {\n                throw new UnauthorizedField(inputField)\n            }\n        }\n    }\n}\n\nfunction checkInputFromRuleFields(rule, inputs) {\n    const { fields: fieldsFromRule } = rule\n    /* istanbul ignore else */\n    if (fieldsFromRule) {\n        if (!Array.isArray(inputs)) {\n            // save\n            validateInputs([inputs], fieldsFromRule)\n        } else {\n            // insert\n            validateInputs(inputs, fieldsFromRule)\n        }\n    }\n}\n\nfunction checkSaveMandatoryFieldsInRules(type: Entity, rules) {\n    // List of not nullable, not PKs field to validate save/insert when allowed fields are specified on the rule\n    const mandatoryFields =\n        Object.values(type.fields)\n            .filter(k => (!k.isNullable && !k.primaryKey))\n            .map(({ camelcase }) => (camelcase))\n\n    for (const rule of rules) {\n        const { entity, save } = rule\n        if (save && save.fields) {\n            const fields = save.fields\n            for (const mField of mandatoryFields) {\n                if (!fields.includes(mField)) {\n                    throw new MissingNotNullableError(mField, entity)\n                }\n            }\n        }\n    }\n}\n\nexport default fp(auth)\n","'use strict'\n\nimport { PlatformaticRule } from '../index.js'\n\nfunction findRule(rules: PlatformaticRule[], roles: string[]) {\n  let found = null\n  for (const rule of rules) {\n    for (const role of roles) {\n      if (rule.role === role) {\n        found = rule\n        break\n      }\n    }\n    if (found) {\n      break\n    }\n  }\n  return found\n}\n\nexport default findRule\n","'use strict'\n\nexport function getRequestFromContext (ctx) {\n  if (ctx && !ctx.reply) {\n    throw new Error('Missing reply in context. You should call this function with { ctx: { reply }}')\n  }\n  return ctx.reply.request\n}\n\nexport function getRoles (request, roleKey, anonymousRole, isRolePath = false) {\n  let output = []\n  const user = request.user\n  if (!user) {\n    output.push(anonymousRole)\n    return output\n  }\n\n  let rolesRaw\n  if (isRolePath) {\n    const roleKeys = roleKey.split('.')\n    rolesRaw = user\n    for (const key of roleKeys) {\n      rolesRaw = rolesRaw[key]\n    }\n  } else {\n    rolesRaw = user[roleKey]\n  }\n\n  if (typeof rolesRaw === 'string') {\n    output = rolesRaw.split(',')\n  } else if (Array.isArray(rolesRaw)) {\n    output = rolesRaw\n  }\n  if (output.length === 0) {\n    output.push(anonymousRole)\n  }\n\n  return output\n}\n","'use strict'\n\nimport createError from '@fastify/error'\n\nconst ERROR_PREFIX = 'PLT_DB_AUTH'\n\nexport const Unauthorized = createError(`${ERROR_PREFIX}_UNAUTHORIZED`, 'operation not allowed', 401)\nexport const UnauthorizedField = createError(`${ERROR_PREFIX}_FIELD_UNAUTHORIZED`, 'field not allowed: %s', 401)\nexport const MissingNotNullableError = createError(`${ERROR_PREFIX}_NOT_NULLABLE_MISSING`, 'missing not nullable field: \"%s\" in save rule for entity \"%s\"')\n"],"mappings":"AAAA,OAAOA,MAAQ,iBACf,OAAOC,MAAW,QAClB,UAAYC,MAAiB,eCE7B,SAASC,EAASC,EAA2BC,EAAiB,CAC5D,IAAIC,EAAQ,KACZ,QAAWC,KAAQH,EAAO,CACxB,QAAWI,KAAQH,EACjB,GAAIE,EAAK,OAASC,EAAM,CACtBF,EAAQC,EACR,KACF,CAEF,GAAID,EACF,KAEJ,CACA,OAAOA,CACT,CAEA,IAAOG,EAAQN,EClBR,SAASO,EAAuBC,EAAK,CAC1C,GAAIA,GAAO,CAACA,EAAI,MACd,MAAM,IAAI,MAAM,gFAAgF,EAElG,OAAOA,EAAI,MAAM,OACnB,CAEO,SAASC,EAAUC,EAASC,EAASC,EAAeC,EAAa,GAAO,CAC7E,IAAIC,EAAS,CAAC,EACRC,EAAOL,EAAQ,KACrB,GAAI,CAACK,EACH,OAAAD,EAAO,KAAKF,CAAa,EAClBE,EAGT,IAAIE,EACJ,GAAIH,EAAY,CACd,IAAMI,EAAWN,EAAQ,MAAM,GAAG,EAClCK,EAAWD,EACX,QAAWG,KAAOD,EAChBD,EAAWA,EAASE,CAAG,CAE3B,MACEF,EAAWD,EAAKJ,CAAO,EAGzB,OAAI,OAAOK,GAAa,SACtBF,EAASE,EAAS,MAAM,GAAG,EAClB,MAAM,QAAQA,CAAQ,IAC/BF,EAASE,GAEPF,EAAO,SAAW,GACpBA,EAAO,KAAKF,CAAa,EAGpBE,CACT,CCpCA,OAAOK,MAAiB,iBAExB,IAAMC,EAAe,cAERC,EAAeF,EAAY,GAAGC,CAAY,gBAAiB,wBAAyB,GAAG,EACvFE,EAAoBH,EAAY,GAAGC,CAAY,sBAAuB,wBAAyB,GAAG,EAClGG,EAA0BJ,EAAY,GAAGC,CAAY,wBAAyB,+DAA+D,EHD1J,OAAOI,MAAkB,yBAKzB,IAAMC,EAAiB,qBA8BvB,eAAeC,EAAKC,EAAsBC,EAAoC,CAC1ED,EAAI,SAASH,EAAc,CACvB,SAAUI,EAAK,cAAgB,2BAC/B,MAAOA,EAAK,YAAc,cAC1B,UAAWA,EAAK,gBAAkB,iBACtC,CAAC,EAED,MAAMD,EAAI,SAASE,EAAoBD,EAAK,SAAS,EAErD,IAAME,EAAcF,EAAK,YACnBG,EAAUH,EAAK,UAAYA,EAAK,SAAW,sBAC3CI,EAAUJ,EAAK,UAAYA,EAAK,SAAW,yBAC3CK,EAAa,CAAC,CAACL,EAAK,SACpBM,EAAgBN,EAAK,eAAiB,YAE5C,eAAeO,GAAoB,CAC/B,IAAMC,EAAY,MAAMT,EAAI,MAAM,QAAQ,uBAAwB,KAAK,EAEvE,GAAI,CAACS,EAAU,GACX,MAAMA,EAGV,IAAMC,EAAQ,MAAMD,EAAU,KAAK,EAC7BE,EAA4B,CAAC,CAC/B,KAAMJ,EACN,SAAU,OAAO,KAAKP,EAAI,aAAa,QAAQ,EAC/C,KAAMC,EAAK,eACX,KAAMA,EAAK,eACX,OAAQA,EAAK,cACjB,CAAC,EAED,QAAWW,KAAQF,EAAO,CACtB,IAAMG,EAAa,MAAMb,EAAI,MAAM,QAAQ,cAAcY,EAAK,EAAE,UAAW,KAAK,EAEhF,GAAI,CAACC,EAAW,GACZ,MAAMA,EAGV,IAAMC,EAAS,MAAMD,EAAW,KAAK,EAErC,QAAWE,KAASD,EAAQ,CACxB,IAAME,EAAWJ,EAAK,KAChB,CAACK,EAAaC,CAAM,EAAIH,EAAM,KAAK,MAAM,GAAG,EAElD,GAAI,CAACf,EAAI,aAAa,SAASkB,CAAM,EAAG,CACpC,IAAMC,EAAUC,EAAkBF,CAAM,EACxClB,EAAI,IAAI,KAAK,mBAAmBkB,CAAM,0CAA0CC,EAAQ,MAAM,IAAI,EAClG,QACJ,CAEA,IAAME,EAAcV,EAAM,KAAKW,GAAKA,EAAE,OAASN,GAAYM,EAAE,SAAWJ,CAAM,EAC9E,GAAIG,EACIpB,EAAK,OACLoB,EAAYJ,CAAW,EAAI,CACvB,OAAQ,CACJ,OAAQZ,CACZ,CACJ,EAEAgB,EAAYJ,CAAW,EAAI,OAE5B,CACH,IAAMM,EAA4B,CAC9B,KAAMP,EACN,OAAAE,CACJ,EAEIjB,EAAK,OACLsB,EAAQN,CAAW,EAAI,CACnB,OAAQ,CACJ,OAAQZ,CACZ,CACJ,EAEAkB,EAAQN,CAAW,EAAI,GAGvBhB,EAAK,WACLsB,EAAQ,SAAW,CACf,OAAQlB,CACZ,GAGJM,EAAM,KAAKY,CAAO,CACtB,CACJ,CACJ,CAEA,OAAAvB,EAAI,IAAI,MAAM,wBAAwB,EACtCA,EAAI,IAAI,MAAMW,CAAK,EACZA,CACX,CAEAX,EAAI,gBAAgB,2BAA4BwB,CAAS,EAEzD,eAAeA,GAAY,CAEvB,MAAM,KAAK,YAAY,EAGvB,IAAIC,EAAiB,GACjBtB,GAAe,KAAK,QAAQ,6BAA6B,IAAMA,IAC3DF,EAAK,UAAU,IACfwB,EAAiB,IAEjB,KAAK,IAAI,KAAK,uBAAuB,EACrC,KAAK,KAAO,IAAI,MAAM,KAAK,QAAS,CAChC,IAAK,CAACC,EAAQC,IAAQ,CAClB,IAAIC,EACJ,GAAKF,EAAOC,EAAI,SAAS,CAAC,EAItBC,EAAQF,EAAOC,EAAI,SAAS,CAAC,MAJJ,CACzB,IAAME,EAASF,EAAI,SAAS,EAAE,YAAY,EAC1CC,EAAQF,EAAOG,CAAM,CACzB,CAIA,MAAI,CAACD,GAASD,EAAI,SAAS,EAAE,YAAY,IAAMvB,EAAQ,YAAY,IAC/DwB,EAAQ9B,GAEL8B,CACX,CACJ,CAAC,IAILH,IAEA,KAAK,KAAO,CAER,CAACrB,CAAO,EAAGN,CACf,EAER,CAEA,SAASsB,EAAkBU,EAAY,CAYnC,OAViB,OAAO,KAAK9B,EAAI,aAAa,QAAQ,EAE7B,OAAO,CAAC+B,EAAKb,IAAW,CAC7C,IAAMc,EAAWC,EAAMH,EAAYZ,CAAM,EACzC,OAAIc,EAAWD,EAAI,WACfA,EAAI,SAAWC,EACfD,EAAI,OAASb,GAEVa,CACX,EAAG,CAAE,SAAU,IAAU,OAAQ,IAAK,CAAC,CAE3C,CAEA/B,EAAI,QAAQ,UAAW,gBAAkB,CACrC,IAAMW,EAAQ,MAAMH,EAAkB,EAGhC0B,EAAc,CAAC,EACrB,QAASC,EAAI,EAAGA,EAAIxB,EAAM,OAAQwB,IAAK,CACnC,IAAMC,EAAOzB,EAAMwB,CAAC,EAEhBE,EAAe,KACnB,GAAID,EAAK,OACLC,EAAe,CAACD,EAAK,MAAM,UACpBA,EAAK,SACZC,EAAe,CAAC,GAAGD,EAAK,QAAQ,MAEhC,OAAM,IAAI,MAAM,wCAAwCD,CAAC,EAAE,EAG/D,QAAWL,KAAcO,EAAc,CACnC,IAAMd,EAAU,CAAE,GAAGa,EAAM,OAAQN,EAAY,SAAU,MAAU,EACnE,GAAI,CAAC9B,EAAI,aAAa,SAASuB,EAAQ,MAAM,EAAG,CAC5C,IAAMJ,EAAUC,EAAkBU,CAAU,EAC5C,MAAM,IAAI,MAAM,mBAAmBA,CAAU,2BAA2BK,CAAC,mBAAmBhB,EAAQ,MAAM,IAAI,CAClH,CAEKe,EAAYJ,CAAU,IACvBI,EAAYJ,CAAU,EAAI,CAAC,GAE/BI,EAAYJ,CAAU,EAAE,KAAKP,CAAO,CACxC,CACJ,CAEA,QAAWe,KAAa,OAAO,KAAKtC,EAAI,aAAa,QAAQ,EAAG,CAC5D,IAAMW,EAAQuB,EAAYI,CAAS,GAAK,CAAC,EACnCC,EAAOvC,EAAI,aAAa,SAASsC,CAAS,EA4BhD,GAzBI,QACwB,GAyBxB,MAAM,IAAI,MAAM,4BAA4BA,CAAS,wCAAwC,EAI7FnC,GACAQ,EAAM,KAAK,CACP,KAAMb,EACN,KAAM,GACN,KAAM,GACN,OAAQ,EACZ,CAAC,EAKL0C,EAAgCD,EAAM5B,CAAK,EAU3CX,EAAI,aAAa,eAAesC,EAAW,CACvC,MAAM,KAAKG,EAAc,CAAE,MAAAC,EAAO,IAAAC,EAAK,OAAAC,EAAQ,GAAGC,CAAS,EAAI,CAAC,EAAG,CAI/D,IAAMC,EAAUC,EAAsBJ,CAAG,EACnCP,EAAO,MAAMY,EAAuBL,EAAKhC,EAAOP,EAASG,EAAeD,CAAU,EACxF,OAAA2C,EAAoBb,EAAK,KAAMQ,GAAU,OAAO,KAAK5C,EAAI,aAAa,SAASsC,CAAS,EAAE,MAAM,CAAC,EACjGI,EAAQ,MAAMQ,EAAgBP,EAAKP,EAAK,KAAMM,EAAOI,EAAQ,IAAI,EAE1DL,EAAa,CAAE,GAAGI,EAAU,MAAAH,EAAO,IAAAC,EAAK,OAAAC,CAAO,CAAC,CAC3D,EACA,MAAM,KAAKO,EAAc,CAAE,MAAAC,EAAO,IAAAT,EAAK,OAAAC,EAAQ,GAAGC,CAAS,EAAG,CAI1D,IAAMC,EAAUC,EAAsBJ,CAAG,EACnCP,EAAO,MAAMY,EAAuBL,EAAKhC,EAAOP,EAASG,EAAeD,CAAU,EAExF,GAAI,CAAC8B,EAAK,KACN,MAAM,IAAIiB,EAKd,GAHAJ,EAAoBb,EAAK,KAAMQ,CAAM,EACrCU,EAAyBlB,EAAK,KAAMgB,CAAK,EAErChB,EAAK,SACL,QAAWT,KAAO,OAAO,KAAKS,EAAK,QAAQ,EAAG,CAC1C,IAAMmB,EAAWnB,EAAK,SAAST,CAAG,EAC9B,OAAO4B,GAAa,WACpBH,EAAMzB,CAAG,EAAI,MAAM4B,EAAS,CAAE,KAAMT,EAAQ,KAAM,IAAAH,EAAK,MAAAS,CAAM,CAAC,EAE9DA,EAAMzB,CAAG,EAAImB,EAAQ,KAAKS,CAAQ,CAE1C,CAGJ,IAAMC,EAAoBJ,EAAMb,EAAK,UAAU,IAAM,OAC/CkB,EAAkB,CAAC,EAGzB,GAFAA,EAAgBlB,EAAK,UAAU,EAAI,CAAE,GAAIa,EAAMb,EAAK,UAAU,CAAE,EAE5DiB,EAAmB,CACnB,IAAMd,EAAQ,MAAMQ,EAAgBP,EAAKP,EAAK,KAAMqB,EAAiBX,EAAQ,IAAI,EAQjF,IANc,MAAMP,EAAK,KAAK,CAC1B,MAAAG,EACA,IAAAC,EACA,OAAAC,CACJ,CAAC,GAES,SAAW,EACjB,MAAM,IAAIS,EAGd,OAAOF,EAAa,CAAE,MAAAC,EAAO,IAAAT,EAAK,OAAAC,EAAQ,GAAGC,CAAS,CAAC,CAC3D,CAEA,OAAOM,EAAa,CAAE,MAAAC,EAAO,IAAAT,EAAK,OAAAC,EAAQ,GAAGC,CAAS,CAAC,CAC3D,EAEA,MAAM,OAAOa,EAAgB,CAAE,OAAAC,EAAQ,IAAAhB,EAAK,OAAAC,EAAQ,GAAGC,CAAS,EAAG,CAI/D,IAAMC,EAAUC,EAAsBJ,CAAG,EACnCP,EAAO,MAAMY,EAAuBL,EAAKhC,EAAOP,EAASG,EAAeD,CAAU,EAExF,GAAI,CAAC8B,EAAK,KACN,MAAM,IAAIiB,EAOd,GAJAJ,EAAoBb,EAAK,KAAMQ,CAAM,EACrCU,EAAyBlB,EAAK,KAAMuB,CAAM,EAGtCvB,EAAK,SACL,QAAWgB,KAASO,EAChB,QAAWhC,KAAO,OAAO,KAAKS,EAAK,QAAQ,EAAG,CAC1C,IAAMmB,EAAWnB,EAAK,SAAST,CAAG,EAC9B,OAAO4B,GAAa,WACpBH,EAAMzB,CAAG,EAAI,MAAM4B,EAAS,CAAE,KAAMT,EAAQ,KAAM,IAAAH,EAAK,MAAAS,CAAM,CAAC,EAE9DA,EAAMzB,CAAG,EAAImB,EAAQ,KAAKS,CAAQ,CAE1C,CAIR,OAAOG,EAAe,CAAE,OAAAC,EAAQ,IAAAhB,EAAK,OAAAC,EAAQ,GAAGC,CAAS,CAAC,CAC9D,EAEA,MAAM,OAAOe,EAAgB,CAAE,MAAAlB,EAAO,IAAAC,EAAK,OAAAC,EAAQ,GAAGC,CAAS,EAAG,CAI9D,IAAMC,EAAUC,EAAsBJ,CAAG,EACnCP,EAAO,MAAMY,EAAuBL,EAAKhC,EAAOP,EAASG,EAAeD,CAAU,EAExF,OAAAoC,EAAQ,MAAMQ,EAAgBP,EAAKP,EAAK,OAAQM,EAAOI,EAAQ,IAAI,EAE5Dc,EAAe,CAAE,MAAAlB,EAAO,IAAAC,EAAK,OAAAC,EAAQ,GAAGC,CAAS,CAAC,CAC7D,EAEA,MAAM,WAAWgB,EAAoB,CAAE,MAAAnB,EAAO,IAAAC,EAAK,OAAAC,EAAQ,GAAGC,CAAS,EAAG,CAItE,IAAMC,EAAUC,EAAsBJ,CAAG,EACnCP,EAAO,MAAMY,EAAuBL,EAAKhC,EAAOP,EAASG,EAAeD,CAAU,EAExF,OAAAoC,EAAQ,MAAMQ,EAAgBP,EAAKP,EAAK,WAAYM,EAAOI,EAAQ,IAAI,EAEhEe,EAAmB,CAAE,GAAGhB,EAAU,MAAAH,EAAO,IAAAC,EAAK,OAAAC,CAAO,CAAC,CACjE,CACJ,CAAC,CACL,CACJ,CAAC,CACL,CAEA,eAAeM,EAAgBP,EAA0BP,EAAMM,EAAOoB,EAAM,CACxE,GAAI,CAAC1B,EACD,MAAM,IAAIiB,EAEd,IAAMP,EAAUC,EAAsBJ,CAAG,EAIzC,GAFAD,EAAQA,GAAS,CAAC,EAEd,OAAON,GAAS,SAAU,CAC1B,GAAM,CAAE,OAAA2B,CAAO,EAAI3B,EAGnB,GAAI2B,EACA,QAAWpC,KAAO,OAAO,KAAKoC,CAAM,EAAG,CACnC,IAAMC,EAAUD,EAAOpC,CAAG,EAC1B,GAAI,OAAOqC,GAAY,SAEnBtB,EAAMf,CAAG,EAAI,CACT,GAAImB,EAAQ,KAAKkB,CAAO,CAC5B,MAMA,SAAWC,KAAa,OAAO,KAAKD,CAAO,EAAG,CAC1C,IAAME,EAASF,EAAQC,CAAS,EAChCvB,EAAMf,CAAG,EAAI,CACT,CAACsC,CAAS,EAAGnB,EAAQ,KAAKoB,CAAM,CACpC,CACJ,CAER,CAER,MAAW,OAAO9B,GAAS,aACvBM,EAAQ,MAAMN,EAAK,CAAE,KAAA0B,EAAM,IAAAnB,EAAK,MAAAD,CAAM,CAAC,GAE3C,OAAOA,CACX,CAEA,eAAeM,EAAuBL,EAA0BhC,EAA2BP,EAAiBG,EAAuBD,EAAa,GAAO,CACnJ,IAAMwC,EAAUC,EAAsBJ,CAAG,EACzC,MAAMG,EAAQ,yBAAyB,EACvC,IAAMpC,EAAQyD,EAASrB,EAAS1C,EAASG,EAAeD,CAAU,EAC5D8B,EAAOgC,EAASzD,EAAOD,CAAK,EAClC,GAAI,CAAC0B,EACD,MAAAO,EAAI,MAAM,QAAQ,IAAI,KAAK,CAAE,MAAAjC,EAAO,MAAAC,CAAM,EAAG,mBAAmB,EAC1D,IAAI0C,EAEd,OAAAV,EAAI,MAAM,QAAQ,IAAI,MAAM,CAAE,MAAAjC,EAAO,KAAA0B,CAAK,EAAG,YAAY,EAClDA,CACX,CAEA,SAASa,EAAoBb,EAAMQ,EAAQ,CACvC,GAAI,CAACR,EACD,MAAM,IAAIiB,EAEd,GAAM,CAAE,OAAQgB,CAAe,EAAIjC,EAEnC,GAAIiC,GACA,QAAWC,KAAS1B,EAChB,GAAI,CAACyB,EAAe,SAASC,CAAK,EAC9B,MAAM,IAAIC,EAAkBD,CAAK,EAIjD,CAEA,IAAME,EAAiB,CAACb,EAAQU,IAAmB,CAC/C,QAAWjB,KAASO,EAAQ,CACxB,IAAMc,EAAc,OAAO,KAAKrB,CAAK,EACrC,QAAWsB,KAAcD,EACrB,GAAI,CAACJ,EAAe,SAASK,CAAU,EACnC,MAAM,IAAIH,EAAkBG,CAAU,CAGlD,CACJ,EAEA,SAASpB,EAAyBlB,EAAMuB,EAAQ,CAC5C,GAAM,CAAE,OAAQU,CAAe,EAAIjC,EAE/BiC,IACK,MAAM,QAAQV,CAAM,EAKrBa,EAAeb,EAAQU,CAAc,EAHrCG,EAAe,CAACb,CAAM,EAAGU,CAAc,EAMnD,CAEA,SAAS7B,EAAgCD,EAAc5B,EAAO,CAE1D,IAAMgE,EACF,OAAO,OAAOpC,EAAK,MAAM,EACpB,OAAOqC,GAAM,CAACA,EAAE,YAAc,CAACA,EAAE,UAAW,EAC5C,IAAI,CAAC,CAAE,UAAAC,CAAU,IAAOA,CAAU,EAE3C,QAAWzC,KAAQzB,EAAO,CACtB,GAAM,CAAE,OAAAO,EAAQ,KAAA4D,CAAK,EAAI1C,EACzB,GAAI0C,GAAQA,EAAK,OAAQ,CACrB,IAAMlC,EAASkC,EAAK,OACpB,QAAWC,KAAUJ,EACjB,GAAI,CAAC/B,EAAO,SAASmC,CAAM,EACvB,MAAM,IAAIC,EAAwBD,EAAQ7D,CAAM,CAG5D,CACJ,CACJ,CAEA,IAAO+D,GAAQC,EAAGnF,CAAI","names":["fp","leven","fastifyUser","findRule","rules","roles","found","rule","role","find_rule_default","getRequestFromContext","ctx","getRoles","request","roleKey","anonymousRole","isRolePath","output","user","rolesRaw","roleKeys","key","createError","ERROR_PREFIX","Unauthorized","UnauthorizedField","MissingNotNullableError","fastifyLogto","PLT_ADMIN_ROLE","auth","app","opts","fastifyUser","adminSecret","roleKey","userKey","isRolePath","anonymousRole","composeLogToRules","rolesResp","roles","rules","role","scopesResp","scopes","scope","roleName","scopeAction","entity","nearest","findNearestEntity","checkExists","r","newRule","setupUser","forceAdminRole","target","key","value","newKey","ruleEntity","acc","distance","leven","entityRules","i","rule","ruleEntities","entityKey","type","checkSaveMandatoryFieldsInRules","originalFind","where","ctx","fields","restOpts","request","getRequestFromContext","findRuleForRequestUser","checkFieldsFromRule","fromRuleToWhere","originalSave","input","Unauthorized","checkInputFromRuleFields","defaults","hasAllPrimaryKeys","whereConditions","originalInsert","inputs","originalDelete","originalUpdateMany","user","checks","clauses","clauseKey","clause","getRoles","find_rule_default","fieldsFromRule","field","UnauthorizedField","validateInputs","inputFields","inputField","mandatoryFields","k","camelcase","save","mField","MissingNotNullableError","index_default","fp"]}

package/package.json

@@ -1,21 +1,34 @@
 {
   "name": "@albirex/platformatic-logto",
-  "version": "1.2.5",
+  "version": "1.3.2",
   "description": "LogTo roles and scopes integrated in Platformatic authorization",
   "type": "module",
-  "main": "lib/index.js",
-  "types": "lib/index.d.ts",
+  "main": "./lib/index.cjs",
+  "module": "./lib/index.js",
+  "types": "./lib/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./lib/index.d.ts",
+        "default": "./lib/index.js"
+      },
+      "require": {
+        "types": "./lib/index.d.cts",
+        "default": "./lib/index.cjs"
+      }
+    }
+  },
   "files": [
-    "/lib"
+    "lib"
   ],
   "repository": {
     "type": "git",
     "url": "https://github.com/albiper/platformatic-logto"
   },
   "peerDependencies": {
+    "@platformatic/db": "^2.66.0",
     "fastify": "^5.0.0",
-    "platformatic": ">=2",
-    "@platformatic/db": "^2.66.0"
+    "platformatic": ">=2"
   },
   "devDependencies": {
     "@eslint/js": "^9.12.0",
@@ -24,11 +37,12 @@
     "dotenv": "^16.5.0",
     "eslint": "^9.12.0",
     "tap": "^21.1.0",
+    "tsup": "^8.5.0",
     "typescript": "~5.5",
     "typescript-eslint": "^8.16.0"
   },
   "dependencies": {
-    "@albirex/fastify-logto": "^1.2.3",
+    "@albirex/fastify-logto": "^1.3.1",
     "@fastify/error": "^4.1.0",
     "@logto/js": "^5.1.1",
     "@logto/node": "^3.1.4",
@@ -44,9 +58,9 @@
   "author": "",
   "license": "ISC",
   "scripts": {
-    "build": "npm run lint && npm run build-ts",
     "build-ts": "tsc",
     "lint": "eslint",
-    "test": "tap --tsconfig=tsconfig.test.json --disable-coverage --jobs=1 test/**/*.test.ts"
+    "test": "tap --tsconfig=tsconfig.test.json --disable-coverage --jobs=1 test/**/*.test.ts",
+    "build": "npm run lint && tsup"
   }
 }

package/lib/utils/errors.d.ts

@@ -1,12 +0,0 @@
-import createError from '@fastify/error';
-export declare const Unauthorized: createError.FastifyErrorConstructor<{
-    code: "PLT_DB_AUTH_UNAUTHORIZED";
-    statusCode: 401;
-}, [any?, any?, any?]>;
-export declare const UnauthorizedField: createError.FastifyErrorConstructor<{
-    code: "PLT_DB_AUTH_FIELD_UNAUTHORIZED";
-    statusCode: 401;
-}, [any?, any?, any?]>;
-export declare const MissingNotNullableError: createError.FastifyErrorConstructor<{
-    code: "PLT_DB_AUTH_NOT_NULLABLE_MISSING";
-}, [any?, any?, any?]>;

package/lib/utils/errors.js

@@ -1,6 +0,0 @@
-'use strict';
-import createError from '@fastify/error';
-const ERROR_PREFIX = 'PLT_DB_AUTH';
-export const Unauthorized = createError(`${ERROR_PREFIX}_UNAUTHORIZED`, 'operation not allowed', 401);
-export const UnauthorizedField = createError(`${ERROR_PREFIX}_FIELD_UNAUTHORIZED`, 'field not allowed: %s', 401);
-export const MissingNotNullableError = createError(`${ERROR_PREFIX}_NOT_NULLABLE_MISSING`, 'missing not nullable field: "%s" in save rule for entity "%s"');

package/lib/utils/find-rule.d.ts

@@ -1,3 +0,0 @@
-import { PlatformaticRule } from '../index.js';
-declare function findRule(rules: PlatformaticRule[], roles: string[]): any;
-export default findRule;

package/lib/utils/find-rule.js

@@ -1,17 +0,0 @@
-'use strict';
-function findRule(rules, roles) {
-    let found = null;
-    for (const rule of rules) {
-        for (const role of roles) {
-            if (rule.role === role) {
-                found = rule;
-                break;
-            }
-        }
-        if (found) {
-            break;
-        }
-    }
-    return found;
-}
-export default findRule;

package/lib/utils/utils.d.ts

@@ -1,2 +0,0 @@
-export declare function getRequestFromContext(ctx: any): any;
-export declare function getRoles(request: any, roleKey: any, anonymousRole: any, isRolePath?: boolean): any[];

package/lib/utils/utils.js

@@ -1,36 +0,0 @@
-'use strict';
-export function getRequestFromContext(ctx) {
-    if (ctx && !ctx.reply) {
-        throw new Error('Missing reply in context. You should call this function with { ctx: { reply }}');
-    }
-    return ctx.reply.request;
-}
-export function getRoles(request, roleKey, anonymousRole, isRolePath = false) {
-    let output = [];
-    const user = request.user;
-    if (!user) {
-        output.push(anonymousRole);
-        return output;
-    }
-    let rolesRaw;
-    if (isRolePath) {
-        const roleKeys = roleKey.split('.');
-        rolesRaw = user;
-        for (const key of roleKeys) {
-            rolesRaw = rolesRaw[key];
-        }
-    }
-    else {
-        rolesRaw = user[roleKey];
-    }
-    if (typeof rolesRaw === 'string') {
-        output = rolesRaw.split(',');
-    }
-    else if (Array.isArray(rolesRaw)) {
-        output = rolesRaw;
-    }
-    if (output.length === 0) {
-        output.push(anonymousRole);
-    }
-    return output;
-}