@axium/server 0.26.3 → 0.28.0

package/dist/auth.js

@@ -46,6 +46,15 @@ export async function getSession(sessionId) {
         .where('sessions.expires', '>', new Date())
         .executeTakeFirstOrThrow();
 }
+export async function requireSession(request, sensitive = false) {
+    const token = getToken(request, sensitive);
+    if (!token)
+        error(401, 'Missing session token');
+    const session = await getSessionAndUser(token).catch(withError('Invalid or expired session token', 401));
+    if (session.user.isSuspended)
+        error(403, 'User is suspended');
+    return session;
+}
 export async function getSessions(userId) {
     return await db.selectFrom('sessions').selectAll().where('userId', '=', userId).where('sessions.expires', '>', new Date()).execute();
 }
@@ -88,12 +97,7 @@ export async function updatePasskeyCounter(id, newCounter) {
     return passkey;
 }
 export async function checkAuthForUser(request, userId, sensitive = false) {
-    const token = getToken(request, sensitive);
-    if (!token)
-        throw error(401, 'Missing token');
-    const session = await getSessionAndUser(token).catch(withError('Invalid or expired session', 401));
-    if (session.user.isSuspended)
-        error(403, 'User is suspended');
+    const session = await requireSession(request);
     if (session.userId !== userId) {
         if (!session.user?.isAdmin)
             error(403, 'User ID mismatch');
@@ -106,42 +110,44 @@ export async function checkAuthForUser(request, userId, sensitive = false) {
         error(403, 'This token can not be used for sensitive actions');
     return Object.assign(session, { accessor: session.user });
 }
-export async function checkAuthForItem(request, itemType, itemId, permission) {
+/**
+ * Authenticate a request against an "item" which has an ACL table.
+ * This will fetch the item, ACLs, users, and the authenticating session.
+ */
+export async function checkAuthForItem(request, itemType, itemId, permissions) {
     const token = getToken(request, false);
     if (!token)
         error(401, 'Missing token');
     const session = await getSessionAndUser(token).catch(() => null);
+    const { userId, user } = session ?? {};
     const item = await db
         .selectFrom(itemType)
         .selectAll()
         .where('id', '=', itemId)
-        .$if(!!session, eb => eb.select(acl.from(itemType, { onlyId: session.userId })))
+        .$if(!!userId, eb => eb.select(acl.from(itemType, { user })))
         .$castTo()
         .executeTakeFirstOrThrow()
-        .catch(withError('Item not found', 404));
+        .catch(e => {
+        if (e.message.includes('no rows'))
+            error(404, itemType + ' not found');
+        throw e;
+    });
     const result = {
         session: session ? omit(session, 'user') : undefined,
         item: omit(item, 'acl'),
-        user: session?.user,
+        user,
         fromACL: false,
     };
-    if (item.publicPermission >= permission)
-        return result;
-    if (!session)
+    if (!session || !user)
         error(403, 'Access denied');
-    if (session.user.isSuspended)
+    if (user.isSuspended)
         error(403, 'User is suspended');
-    if (session.userId == item.userId)
+    if (userId == item.userId)
         return result;
     result.fromACL = true;
     if (!item.acl || !item.acl.length)
         error(403, 'Access denied');
-    const [control] = item.acl;
-    if (control.userId !== session.userId) {
-        await audit('acl_id_mismatch', session.userId, { item: itemId });
-        error(500, 'Access control entry does not match session user');
-    }
-    if (control.permission >= permission)
-        return result;
-    error(403, 'Access denied');
+    if (acl.check(item.acl, permissions).size)
+        error(403, 'Access denied');
+    return result;
 }

package/dist/cli.d.ts

@@ -1,2 +1,8 @@
-#!/usr/bin/env node
-export {};
+import type { UserInternal } from '@axium/core';
+export declare function userText(user: UserInternal, bold?: boolean): string;
+export declare function lookupUser(lookup: string): Promise<UserInternal>;
+/**
+ * Updates an array of strings by adding or removing items.
+ * Only returns whether the array was updated and diff text for what actually changed.
+ */
+export declare function diffUpdate(original: string[], add?: string[], remove?: string[]): [updated: boolean, newValue: string[], diffText: string];