@application-kit/authorization 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @application-kit/authorization
 
+## 0.4.0
+
+### Minor Changes
+
+- 92d5b04: Вход `/vue`: `installAuthorization(app, { accessDenied, grants, resolveActor, router })` — ability на приложение, `<Can>`,
+  `useAbility()` и гвард маршрутов по `meta.can`; `canAccessRoute` и расширение `RouteMeta.can`. Гранты, источник актора и маршрут
+  отказа приходят параметрами. `@casl/vue`, `vue`, `vue-router` — опциональные peer, корневой вход их не тянет.
+
 ## 0.3.0
 
 ### Minor Changes

package/README.md

@@ -10,7 +10,8 @@
 yarn add @application-kit/authorization
 ```
 
-Peer-зависимости: `@casl/ability`, `@nestjs/common`, `@nestjs/core`, `nestjs-pino`. Все обязательные.
+Peer-зависимости: `@casl/ability`, `@nestjs/common`, `@nestjs/core`, `nestjs-pino` — обязательные; `@casl/vue`, `vue`,
+`vue-router` — опциональные, нужны только входу `/vue`.
 `@nestjs/graphql` пакету не нужен: guard узнаёт GraphQL-запрос по типу контекста и работает и в приложении без GraphQL.
 
 ## Входы
@@ -19,6 +20,7 @@ Peer-зависимости: `@casl/ability`, `@nestjs/common`, `@nestjs/core`,
 |------|----------|-------|
 | `@application-kit/authorization` | сервер и браузер: реестры, `buildAbilityFor`, `composeAbilityGrants` | только `@casl/ability` |
 | `@application-kit/authorization/nest` | сервер: guard, декораторы, фабрика, логгер | `@nestjs/*`, `nestjs-pino` |
+| `@application-kit/authorization/vue` | клиент и SSR: ability на приложение, `<Can>`, гвард маршрутов по `meta.can` | `vue`, `vue-router`, `@casl/vue` |
 
 Корневой вход не импортирует Nest — его можно собирать в браузерный бандл.
 
@@ -46,6 +48,28 @@ const grants = composeAbilityGrants(['EDITOR', 'VIEWER'], articleGrants, comment
 const ability = buildAbilityFor({ role: 'EDITOR' }, grants)
 ```
 
+## Vue
+
+`installAuthorization(app, options)` ставит ability (свой экземпляр на приложение, поэтому и на запрос SSR), `<Can>`,
+`useAbility()` и гвард: маршрут с `meta.can` без нужного права уводит на `accessDenied`. Решение только о показе
+интерфейса: источник истины — бэкенд. `RouteMeta.can` объявляет сам вход.
+
+```ts
+installAuthorization(app, {
+  accessDenied: { name: 'ACCESS_DENIED' }, // сам не несёт meta.can: отказ на нём зациклился бы
+  grants,
+  resolveActor: async () => meRepository.loadMe(), // null — гость; исполняется в контексте приложения
+  router,
+})
+
+const routes = [{ path: '/console', component: Console, meta: { can: { action: 'read', subject: 'Console' } } }]
+```
+
+Актор запрашивается лениво, на первом маршруте с `meta.can`: маршруты без него запроса не ждут. Ошибка `resolveActor`
+читается как гость, и следующий такой переход спросит снова — это и покрывает вход без перезагрузки страницы. Актор,
+приехавший снапшотом SSR, `resolveActor` возвращает сам, без запроса. `canAccessRoute(ability, route)` — то же решение
+отдельно от гварда.
+
 ## Nest
 
 - `PoliciesGuard` — глобальный guard (`APP_GUARD`): обработчик с `@Public()` пропускается, с `@CheckPolicies(...)` —

package/dist/cjs/vue/index.d.ts

@@ -0,0 +1,2 @@
+export * from './install-authorization.js';
+export * from './route-ability.js';

package/dist/cjs/vue/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./install-authorization.js"), exports);
+__exportStar(require("./route-ability.js"), exports);

package/dist/cjs/vue/install-authorization.d.ts

@@ -0,0 +1,11 @@
+import type { App } from 'vue';
+import type { RouteLocationRaw, Router } from 'vue-router';
+import type { AbilityActorInterface } from '../build-ability.js';
+import type { AbilityGrantMap } from '../types/ability-grant.js';
+export interface InstallAuthorizationOptionsInterface {
+    accessDenied: RouteLocationRaw;
+    grants: AbilityGrantMap;
+    resolveActor(): Promise<AbilityActorInterface | null>;
+    router: Router;
+}
+export declare const installAuthorization: (app: App, options: InstallAuthorizationOptionsInterface) => void;

package/dist/cjs/vue/install-authorization.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.installAuthorization = void 0;
+const ability_1 = require("@casl/ability");
+const vue_1 = require("@casl/vue");
+const build_ability_js_1 = require("../build-ability.js");
+const route_ability_js_1 = require("./route-ability.js");
+const installAuthorization = (app, options) => {
+    const ability = (0, ability_1.createMongoAbility)();
+    app.use(vue_1.abilitiesPlugin, ability);
+    app.component('Can', vue_1.Can);
+    const hydrateAbility = async () => {
+        try {
+            const actor = await app.runWithContext(async () => options.resolveActor());
+            ability.update((0, build_ability_js_1.buildAbilityFor)(actor, options.grants).rules);
+        }
+        catch {
+        }
+    };
+    options.router.beforeEach(async (to) => {
+        if (to.meta.can !== undefined && ability.rules.length === 0) {
+            await hydrateAbility();
+        }
+        return (0, route_ability_js_1.canAccessRoute)(ability, to) || options.accessDenied;
+    });
+};
+exports.installAuthorization = installAuthorization;

package/dist/cjs/vue/route-ability.d.ts

@@ -0,0 +1,14 @@
+import type { AnyAbility } from '@casl/ability';
+import type { RouteLocationNormalized } from 'vue-router';
+import type { Action } from '../types/actions.js';
+import type { Subject } from '../types/subjects.js';
+export interface RouteAbilityRequirementInterface {
+    action: Action;
+    subject: Subject;
+}
+declare module 'vue-router' {
+    interface RouteMeta {
+        can?: RouteAbilityRequirementInterface;
+    }
+}
+export declare const canAccessRoute: (ability: AnyAbility, route: Pick<RouteLocationNormalized, "meta">) => boolean;

package/dist/cjs/vue/route-ability.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canAccessRoute = void 0;
+const canAccessRoute = (ability, route) => {
+    const requirement = route.meta.can;
+    return requirement === undefined || ability.can(requirement.action, requirement.subject);
+};
+exports.canAccessRoute = canAccessRoute;

package/dist/esm/vue/index.d.ts

@@ -0,0 +1,2 @@
+export * from './install-authorization.js';
+export * from './route-ability.js';

package/dist/esm/vue/index.js

@@ -0,0 +1,2 @@
+export * from './install-authorization.js';
+export * from './route-ability.js';

package/dist/esm/vue/install-authorization.d.ts

@@ -0,0 +1,11 @@
+import type { App } from 'vue';
+import type { RouteLocationRaw, Router } from 'vue-router';
+import type { AbilityActorInterface } from '../build-ability.js';
+import type { AbilityGrantMap } from '../types/ability-grant.js';
+export interface InstallAuthorizationOptionsInterface {
+    accessDenied: RouteLocationRaw;
+    grants: AbilityGrantMap;
+    resolveActor(): Promise<AbilityActorInterface | null>;
+    router: Router;
+}
+export declare const installAuthorization: (app: App, options: InstallAuthorizationOptionsInterface) => void;

package/dist/esm/vue/install-authorization.js

@@ -0,0 +1,23 @@
+import { createMongoAbility } from '@casl/ability';
+import { abilitiesPlugin, Can } from '@casl/vue';
+import { buildAbilityFor } from '../build-ability.js';
+import { canAccessRoute } from './route-ability.js';
+export const installAuthorization = (app, options) => {
+    const ability = createMongoAbility();
+    app.use(abilitiesPlugin, ability);
+    app.component('Can', Can);
+    const hydrateAbility = async () => {
+        try {
+            const actor = await app.runWithContext(async () => options.resolveActor());
+            ability.update(buildAbilityFor(actor, options.grants).rules);
+        }
+        catch {
+        }
+    };
+    options.router.beforeEach(async (to) => {
+        if (to.meta.can !== undefined && ability.rules.length === 0) {
+            await hydrateAbility();
+        }
+        return canAccessRoute(ability, to) || options.accessDenied;
+    });
+};

package/dist/esm/vue/route-ability.d.ts

@@ -0,0 +1,14 @@
+import type { AnyAbility } from '@casl/ability';
+import type { RouteLocationNormalized } from 'vue-router';
+import type { Action } from '../types/actions.js';
+import type { Subject } from '../types/subjects.js';
+export interface RouteAbilityRequirementInterface {
+    action: Action;
+    subject: Subject;
+}
+declare module 'vue-router' {
+    interface RouteMeta {
+        can?: RouteAbilityRequirementInterface;
+    }
+}
+export declare const canAccessRoute: (ability: AnyAbility, route: Pick<RouteLocationNormalized, "meta">) => boolean;

package/dist/esm/vue/route-ability.js

@@ -0,0 +1,4 @@
+export const canAccessRoute = (ability, route) => {
+    const requirement = route.meta.can;
+    return requirement === undefined || ability.can(requirement.action, requirement.subject);
+};

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@application-kit/authorization",
-  "version": "0.3.0",
-  "description": "Авторизация на CASL для NestJS и браузера: реестры subject'ов и ролей, ability из грантов модулей, глобальный guard политик",
+  "version": "0.4.0",
+  "description": "Авторизация на CASL для NestJS и браузера: реестры subject'ов и ролей, ability из грантов модулей, глобальный guard политик, гвард маршрутов Vue",
   "keywords": [
     "authorization",
     "casl",
     "nestjs",
-    "policies"
+    "policies",
+    "vue"
   ],
   "homepage": "https://gitlab.com/application-kit/application-kit/-/tree/main/packages/authorization",
   "bugs": "https://gitlab.com/application-kit/application-kit/-/issues",
@@ -42,7 +43,17 @@
         "default": "./dist/cjs/nest/index.js"
       }
     },
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./vue": {
+      "import": {
+        "types": "./dist/esm/vue/index.d.ts",
+        "default": "./dist/esm/vue/index.js"
+      },
+      "require": {
+        "types": "./dist/cjs/vue/index.d.ts",
+        "default": "./dist/cjs/vue/index.js"
+      }
+    }
   },
   "main": "./dist/cjs/index.js",
   "module": "./dist/esm/index.js",
@@ -51,13 +62,14 @@
     "dist"
   ],
   "scripts": {
-    "build": "rm -rf ./dist && node ../../scripts/barrels.mjs create ./src --entry-only=nest,internal && tsc --project tsconfig.build.json && tsc --project tsconfig.build.cjs.json && node ../../scripts/barrels.mjs clean ./src && node ../../scripts/mark-cjs.mjs ./dist/cjs",
+    "build": "rm -rf ./dist && node ../../scripts/barrels.mjs create ./src --entry-only=nest,internal,vue && tsc --project tsconfig.build.json && tsc --project tsconfig.build.cjs.json && node ../../scripts/barrels.mjs clean ./src && node ../../scripts/mark-cjs.mjs ./dist/cjs",
     "lint:tsc": "tsc --noEmit --pretty --project .",
     "test:mutation": "stryker run",
     "test:unit": "vitest run"
   },
   "devDependencies": {
     "@casl/ability": "^7.0.1",
+    "@casl/vue": "^3.0.1",
     "@nestjs/common": "^11.2.7",
     "@nestjs/core": "^11.2.7",
     "@nestjs/testing": "^11.2.7",
@@ -70,13 +82,29 @@
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.2",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.11",
+    "vue": "^3.5.41",
+    "vue-router": "^5.2.0"
   },
   "peerDependencies": {
     "@casl/ability": "^7.0.0",
+    "@casl/vue": "^3.0.0",
     "@nestjs/common": "^11.0.0",
     "@nestjs/core": "^11.0.0",
-    "nestjs-pino": "^4.6.1"
+    "nestjs-pino": "^4.6.1",
+    "vue": "^3.5.0",
+    "vue-router": "^5.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@casl/vue": {
+      "optional": true
+    },
+    "vue": {
+      "optional": true
+    },
+    "vue-router": {
+      "optional": true
+    }
   },
   "engines": {
     "node": ">=24"