@apipass/cerbos-pep 0.0.67

package/lib/cerbos.decorator.d.ts

@@ -0,0 +1,9 @@
+export declare const CERBOS_METADATA_KEY = "cerbos:permission";
+export interface CerbosPermission {
+    resource: {
+        kind: string;
+        id?: string;
+    };
+    actions: string[];
+}
+export declare const CerbosPermission: (permission: CerbosPermission) => import("@nestjs/common").CustomDecorator<string>;

package/lib/cerbos.decorator.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CerbosPermission = exports.CERBOS_METADATA_KEY = void 0;
+const common_1 = require("@nestjs/common");
+exports.CERBOS_METADATA_KEY = 'cerbos:permission';
+const CerbosPermission = (permission) => (0, common_1.SetMetadata)(exports.CERBOS_METADATA_KEY, permission);
+exports.CerbosPermission = CerbosPermission;
+//# sourceMappingURL=cerbos.decorator.js.map

package/lib/cerbos.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cerbos.decorator.js","sourceRoot":"","sources":["../src/cerbos.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA4C;AAE/B,QAAA,mBAAmB,GAAG,mBAAmB,CAAA;AAU/C,MAAM,gBAAgB,GAAG,CAAC,UAA4B,EAAE,EAAE,CAC/D,IAAA,oBAAW,EAAC,2BAAmB,EAAE,UAAU,CAAC,CAAA;AADjC,QAAA,gBAAgB,oBACiB"}

package/lib/cerbos.interceptor.d.ts

@@ -0,0 +1,8 @@
+import { type NestInterceptor, type ExecutionContext, type CallHandler } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { type Observable } from 'rxjs';
+export declare class CerbosInterceptor implements NestInterceptor {
+    private readonly reflector;
+    constructor(reflector: Reflector);
+    intercept(context: ExecutionContext, next: CallHandler): Promise<Observable<any>>;
+}

package/lib/cerbos.interceptor.js

@@ -0,0 +1,74 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CerbosInterceptor = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const cerbos_decorator_1 = require("./cerbos.decorator");
+let cerbosInstance = null;
+async function getCerbos() {
+    if (!cerbosInstance) {
+        const { HTTP: Cerbos } = (await import('@cerbos/http'));
+        cerbosInstance = new Cerbos('http://127.0.0.1:3592');
+    }
+    return cerbosInstance;
+}
+let CerbosInterceptor = class CerbosInterceptor {
+    constructor(reflector) {
+        this.reflector = reflector;
+    }
+    async intercept(context, next) {
+        const permission = this.reflector.getAllAndOverride(cerbos_decorator_1.CERBOS_METADATA_KEY, [context.getHandler(), context.getClass()]);
+        if (!permission) {
+            return next.handle();
+        }
+        const ctx = context.switchToHttp();
+        const request = ctx.getRequest();
+        const role = request.headers.role?.toLowerCase();
+        const accountId = request.headers.account_id;
+        if (!role || !accountId) {
+            throw new common_1.ForbiddenException('Missing authorization headers');
+        }
+        const cerbosRequest = {
+            principal: {
+                id: role,
+                roles: [role],
+                attributes: { accountId }
+            },
+            resource: {
+                kind: permission.resource.kind,
+                id: permission.resource.id ?? context.getHandler().name,
+                attributes: {}
+            },
+            actions: permission.actions
+        };
+        try {
+            const cerbos = await getCerbos();
+            const result = await cerbos.checkResource(cerbosRequest);
+            const allowed = permission.actions.every((action) => result.isAllowed(action));
+            if (!allowed) {
+                throw new common_1.ForbiddenException('Access denied by Cerbos');
+            }
+        }
+        catch (error) {
+            if (error instanceof common_1.ForbiddenException)
+                throw error;
+            throw new common_1.ForbiddenException('Error checking permissions');
+        }
+        return next.handle();
+    }
+};
+exports.CerbosInterceptor = CerbosInterceptor;
+exports.CerbosInterceptor = CerbosInterceptor = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.Reflector])
+], CerbosInterceptor);
+//# sourceMappingURL=cerbos.interceptor.js.map

package/lib/cerbos.interceptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cerbos.interceptor.js","sourceRoot":"","sources":["../src/cerbos.interceptor.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAMuB;AACvB,uCAAwC;AAExC,yDAA+E;AAI/E,IAAI,cAAc,GAAkD,IAAI,CAAA;AAExE,KAAK,UAAU,SAAS;IACtB,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAqB,CAAA;QAC3E,cAAc,GAAG,IAAI,MAAM,CAAC,uBAAuB,CAAC,CAAA;IACtD,CAAC;IACD,OAAO,cAAc,CAAA;AACvB,CAAC;AAGM,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,YAA8B,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IAAG,CAAC;IAEtD,KAAK,CAAC,SAAS,CACX,OAAyB,EACzB,IAAiB;QAEnB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC/C,sCAAmB,EACnB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC7C,CAAA;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAA;QACtB,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAA;QAClC,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAAE,CAAA;QAEhC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,CAAA;QAChD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAA;QAE5C,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,2BAAkB,CAAC,+BAA+B,CAAC,CAAA;QAC/D,CAAC;QAED,MAAM,aAAa,GAAG;YACpB,SAAS,EAAE;gBACT,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,CAAC,IAAI,CAAC;gBACb,UAAU,EAAE,EAAE,SAAS,EAAE;aAC1B;YACD,QAAQ,EAAE;gBACR,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI;gBAC9B,EAAE,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI;gBACvD,UAAU,EAAE,EAAE;aACf;YACD,OAAO,EAAE,UAAU,CAAC,OAAO;SAC5B,CAAA;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;YAEhC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,CAAA;YAExD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAChD,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAC3B,CAAA;YAED,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,2BAAkB,CAAC,yBAAyB,CAAC,CAAA;YACzD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,2BAAkB;gBAAE,MAAM,KAAK,CAAA;YACpD,MAAM,IAAI,2BAAkB,CAAC,4BAA4B,CAAC,CAAA;QAC5D,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,EAAE,CAAA;IACtB,CAAC;CACF,CAAA;AA3DY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAE8B,gBAAS;GADvC,iBAAiB,CA2D7B"}

package/lib/index.d.ts

@@ -0,0 +1,2 @@
+export * from './cerbos.decorator';
+export * from './cerbos.interceptor';

package/lib/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./cerbos.decorator"), exports);
+__exportStar(require("./cerbos.interceptor"), exports);
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAkC;AAClC,uDAAoC"}

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@apipass/cerbos-pep",
+  "version": "0.0.67",
+  "description": "Cerbos PEP utility for NestJS",
+  "author": "Junie",
+  "license": "ISC",
+  "main": "lib/index.js",
+  "typings": "lib/index.d.ts",
+  "directories": {
+    "lib": "lib"
+  },
+  "files": [
+    "lib"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "tsc": "tsc"
+  },
+  "dependencies": {
+    "@cerbos/http": "^0.24.1",
+    "@nestjs/common": "10.4.15",
+    "@nestjs/core": "10.4.15",
+    "rxjs": "^7.8.1"
+  },
+  "peerDependencies": {
+    "@nestjs/common": "10.4.15",
+    "@nestjs/core": "10.4.15"
+  },
+  "gitHead": "a3093f396fb97251363206ddd600c21436a65587"
+}