@axinom/mosaic-id-guard 0.22.0 → 0.23.0-rc.1

package/dist/message-bus/message-handler-permissions.d.ts

@@ -1,8 +1,16 @@
 import { OnMessageMiddleware } from '@axinom/mosaic-message-bus';
+import { AuthenticatedManagementSubject } from '../common';
 /**
  * Ensures that the subject contains the required permissions to execute the message handler
  * @param permissions - the list of permissions that allow to use that message handler
  * @param serviceId - the service ID of this service
  */
 export declare const permissionsMiddleware: <TContent = unknown>(permissions: string[], serviceId: string) => OnMessageMiddleware<TContent>;
+/**
+ * Ensures that the subject contains the required permissions to execute a piece of code
+ * @param subject The management subject - most often parsed from a JWT
+ * @param permissions - the list of permissions that allow to use that message handler
+ * @param serviceId - the service ID of this service
+ */
+export declare const permissionsCheck: (subject: AuthenticatedManagementSubject | undefined, permissions: string[], serviceId: string) => Promise<void>;
 //# sourceMappingURL=message-handler-permissions.d.ts.map

package/dist/message-bus/message-handler-permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"message-handler-permissions.d.ts","sourceRoot":"","sources":["../../src/message-bus/message-handler-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,mBAAmB,EACpB,MAAM,4BAA4B,CAAC;AAIpC;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,oCACnB,MAAM,EAAE,aACV,MAAM,kCAmClB,CAAC"}
+{"version":3,"file":"message-handler-permissions.d.ts","sourceRoot":"","sources":["../../src/message-bus/message-handler-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,mBAAmB,EACpB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,8BAA8B,EAAE,MAAM,WAAW,CAAC;AAG3D;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,oCACnB,MAAM,EAAE,aACV,MAAM,kCAalB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,YAClB,8BAA8B,GAAG,SAAS,eACtC,MAAM,EAAE,aACV,MAAM,KAChB,QAAQ,IAAI,CAmBd,CAAC"}

package/dist/message-bus/message-handler-permissions.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.permissionsMiddleware = void 0;
+exports.permissionsCheck = exports.permissionsMiddleware = void 0;
 /**
  * Ensures that the subject contains the required permissions to execute the message handler
  * @param permissions - the list of permissions that allow to use that message handler
@@ -8,22 +8,31 @@ exports.permissionsMiddleware = void 0;
  */
 const permissionsMiddleware = (permissions, serviceId) => {
     return async (content, message, ackOrNack, next) => {
-        var _a;
         const subject = message
             .subject;
-        if (subject === undefined) {
-            throw new Error('Permission check failed as no authentication subject was provided.');
-        }
-        const subjectPermissions = (_a = subject.permissions) === null || _a === void 0 ? void 0 : _a[serviceId];
-        if (subjectPermissions === undefined ||
-            !Array.isArray(subjectPermissions)) {
-            throw new Error('Permission check failed as the subject has no permissions for this service.');
-        }
-        if (!permissions.some((p) => subjectPermissions.includes(p))) {
-            throw new Error(`Permission check failed as the subject has no permissions for this message handler. The subject permissions are "${subjectPermissions}" while the required permissions are "${permissions}".`);
-        }
+        await (0, exports.permissionsCheck)(subject, permissions, serviceId);
         await (next === null || next === void 0 ? void 0 : next(content, message, ackOrNack));
     };
 };
 exports.permissionsMiddleware = permissionsMiddleware;
+/**
+ * Ensures that the subject contains the required permissions to execute a piece of code
+ * @param subject The management subject - most often parsed from a JWT
+ * @param permissions - the list of permissions that allow to use that message handler
+ * @param serviceId - the service ID of this service
+ */
+const permissionsCheck = async (subject, permissions, serviceId) => {
+    var _a;
+    if (subject === undefined) {
+        throw new Error('Permission check failed as no authentication subject was provided.');
+    }
+    const subjectPermissions = (_a = subject.permissions) === null || _a === void 0 ? void 0 : _a[serviceId];
+    if (subjectPermissions === undefined || !Array.isArray(subjectPermissions)) {
+        throw new Error('Permission check failed as the subject has no permissions for this service.');
+    }
+    if (!permissions.some((p) => subjectPermissions.includes(p))) {
+        throw new Error(`Permission check failed as the subject has no permissions for this message handler. The subject permissions are "${subjectPermissions}" while the required permissions are "${permissions}".`);
+    }
+};
+exports.permissionsCheck = permissionsCheck;
 //# sourceMappingURL=message-handler-permissions.js.map

package/dist/message-bus/message-handler-permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"message-handler-permissions.js","sourceRoot":"","sources":["../../src/message-bus/message-handler-permissions.ts"],"names":[],"mappings":";;;AAQA;;;;GAIG;AACI,MAAM,qBAAqB,GAAG,CACnC,WAAqB,EACrB,SAAiB,EACc,EAAE;IACjC,OAAO,KAAK,EACV,OAAkC,EAClC,OAA8B,EAC9B,SAAoB,EACpB,IAAoC,EACrB,EAAE;;QACjB,MAAM,OAAO,GAAI,OAAqD;aACnE,OAAO,CAAC;QAEX,IAAI,OAAO,KAAK,SAAS,EAAE;YACzB,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;SACH;QAED,MAAM,kBAAkB,GAAG,MAAA,OAAO,CAAC,WAAW,0CAAG,SAAS,CAAC,CAAC;QAC5D,IACE,kBAAkB,KAAK,SAAS;YAChC,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAClC;YACA,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;SACH;QAED,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;YAC5D,MAAM,IAAI,KAAK,CACb,oHAAoH,kBAAkB,yCAAyC,WAAW,IAAI,CAC/L,CAAC;SACH;QAED,MAAM,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAG,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC,CAAC;AArCW,QAAA,qBAAqB,yBAqChC"}
+{"version":3,"file":"message-handler-permissions.js","sourceRoot":"","sources":["../../src/message-bus/message-handler-permissions.ts"],"names":[],"mappings":";;;AASA;;;;GAIG;AACI,MAAM,qBAAqB,GAAG,CACnC,WAAqB,EACrB,SAAiB,EACc,EAAE;IACjC,OAAO,KAAK,EACV,OAAkC,EAClC,OAA8B,EAC9B,SAAoB,EACpB,IAAoC,EACrB,EAAE;QACjB,MAAM,OAAO,GAAI,OAAqD;aACnE,OAAO,CAAC;QACX,MAAM,IAAA,wBAAgB,EAAC,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QACxD,MAAM,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAG,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC,CAAC;AAfW,QAAA,qBAAqB,yBAehC;AAEF;;;;;GAKG;AACI,MAAM,gBAAgB,GAAG,KAAK,EACnC,OAAmD,EACnD,WAAqB,EACrB,SAAiB,EACF,EAAE;;IACjB,IAAI,OAAO,KAAK,SAAS,EAAE;QACzB,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;KACH;IAED,MAAM,kBAAkB,GAAG,MAAA,OAAO,CAAC,WAAW,0CAAG,SAAS,CAAC,CAAC;IAC5D,IAAI,kBAAkB,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE;QAC1E,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;KACH;IAED,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;QAC5D,MAAM,IAAI,KAAK,CACb,oHAAoH,kBAAkB,yCAAyC,WAAW,IAAI,CAC/L,CAAC;KACH;AACH,CAAC,CAAC;AAvBW,QAAA,gBAAgB,oBAuB3B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axinom/mosaic-id-guard",
-  "version": "0.22.0",
+  "version": "0.23.0-rc.1",
   "description": "Authentication and authorization helpers for Axinom Mosaic services",
   "author": "Axinom",
   "license": "PROPRIETARY",
@@ -28,9 +28,9 @@
     "lint": "eslint . --ext .ts,.tsx,.js --color --cache"
   },
   "dependencies": {
-    "@axinom/mosaic-id-utils": "^0.15.7",
-    "@axinom/mosaic-message-bus": "^0.17.0",
-    "@axinom/mosaic-service-common": "^0.39.0",
+    "@axinom/mosaic-id-utils": "^0.15.8-rc.1",
+    "@axinom/mosaic-message-bus": "^0.18.0-rc.1",
+    "@axinom/mosaic-service-common": "^0.40.0-rc.1",
     "amqplib": "^0.10.3",
     "express": "^4.17.1",
     "express-bearer-token": "^2.4.0",
@@ -42,7 +42,7 @@
     "jsonwebtoken": "^9.0.0",
     "jwks-rsa": "^1.8.1",
     "lru-cache": "^7.18.3",
-    "pg": "^8.5.1",
+    "pg": "^8.11.3",
     "postgraphile": "^4.13.0",
     "rascal": "^14.0.1",
     "subscriptions-transport-ws": "^0.9.19"
@@ -62,5 +62,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "7eb762e7cec90f882c2fe11f5c294c44fc2c3bc3"
+  "gitHead": "19386d17cc908f49f470c3a2095c084a93ceab55"
 }

package/src/message-bus/message-handler-permissions.ts

@@ -4,6 +4,7 @@ import {
   OnMessageMiddleware,
 } from '@axinom/mosaic-message-bus';
 import { AckOrNack } from 'rascal';
+import { AuthenticatedManagementSubject } from '../common';
 import { AuthenticatedManagementSubjectMessageInfo } from './message-handler-authentication';
 
 /**
@@ -23,29 +24,38 @@ export const permissionsMiddleware = <TContent = unknown>(
   ): Promise<void> => {
     const subject = (message as AuthenticatedManagementSubjectMessageInfo)
       .subject;
+    await permissionsCheck(subject, permissions, serviceId);
+    await next?.(content, message, ackOrNack);
+  };
+};
 
-    if (subject === undefined) {
-      throw new Error(
-        'Permission check failed as no authentication subject was provided.',
-      );
-    }
-
-    const subjectPermissions = subject.permissions?.[serviceId];
-    if (
-      subjectPermissions === undefined ||
-      !Array.isArray(subjectPermissions)
-    ) {
-      throw new Error(
-        'Permission check failed as the subject has no permissions for this service.',
-      );
-    }
+/**
+ * Ensures that the subject contains the required permissions to execute a piece of code
+ * @param subject The management subject - most often parsed from a JWT
+ * @param permissions - the list of permissions that allow to use that message handler
+ * @param serviceId - the service ID of this service
+ */
+export const permissionsCheck = async (
+  subject: AuthenticatedManagementSubject | undefined,
+  permissions: string[],
+  serviceId: string,
+): Promise<void> => {
+  if (subject === undefined) {
+    throw new Error(
+      'Permission check failed as no authentication subject was provided.',
+    );
+  }
 
-    if (!permissions.some((p) => subjectPermissions.includes(p))) {
-      throw new Error(
-        `Permission check failed as the subject has no permissions for this message handler. The subject permissions are "${subjectPermissions}" while the required permissions are "${permissions}".`,
-      );
-    }
+  const subjectPermissions = subject.permissions?.[serviceId];
+  if (subjectPermissions === undefined || !Array.isArray(subjectPermissions)) {
+    throw new Error(
+      'Permission check failed as the subject has no permissions for this service.',
+    );
+  }
 
-    await next?.(content, message, ackOrNack);
-  };
+  if (!permissions.some((p) => subjectPermissions.includes(p))) {
+    throw new Error(
+      `Permission check failed as the subject has no permissions for this message handler. The subject permissions are "${subjectPermissions}" while the required permissions are "${permissions}".`,
+    );
+  }
 };