@carlonicora/nestjs-neo4jsonapi 6.5.0 → 6.5.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/common/interfaces/s3.key-access.policy.interface.d.ts +6 -1
- package/dist/common/interfaces/s3.key-access.policy.interface.d.ts.map +1 -1
- package/dist/common/interfaces/s3.key-access.policy.interface.js +6 -1
- package/dist/common/interfaces/s3.key-access.policy.interface.js.map +1 -1
- package/dist/core/security/services/security.service.d.ts +4 -0
- package/dist/core/security/services/security.service.d.ts.map +1 -1
- package/dist/core/security/services/security.service.js +5 -1
- package/dist/core/security/services/security.service.js.map +1 -1
- package/dist/core/websocket/gateways/event.gateway.d.ts.map +1 -1
- package/dist/core/websocket/gateways/event.gateway.js +18 -9
- package/dist/core/websocket/gateways/event.gateway.js.map +1 -1
- package/dist/core/websocket/services/presence.cron.service.d.ts.map +1 -1
- package/dist/core/websocket/services/presence.cron.service.js +3 -2
- package/dist/core/websocket/services/presence.cron.service.js.map +1 -1
- package/dist/core/websocket/services/websocket.service.d.ts +23 -1
- package/dist/core/websocket/services/websocket.service.d.ts.map +1 -1
- package/dist/core/websocket/services/websocket.service.js +37 -4
- package/dist/core/websocket/services/websocket.service.js.map +1 -1
- package/dist/foundations/auth/repositories/auth.repository.d.ts +11 -0
- package/dist/foundations/auth/repositories/auth.repository.d.ts.map +1 -1
- package/dist/foundations/auth/repositories/auth.repository.js +37 -0
- package/dist/foundations/auth/repositories/auth.repository.js.map +1 -1
- package/dist/foundations/auth/services/auth.service.d.ts.map +1 -1
- package/dist/foundations/auth/services/auth.service.js +15 -9
- package/dist/foundations/auth/services/auth.service.js.map +1 -1
- package/dist/foundations/company/services/company.service.d.ts +3 -1
- package/dist/foundations/company/services/company.service.d.ts.map +1 -1
- package/dist/foundations/company/services/company.service.js +8 -2
- package/dist/foundations/company/services/company.service.js.map +1 -1
- package/dist/foundations/how-to/controllers/how-to.controller.d.ts +4 -0
- package/dist/foundations/how-to/controllers/how-to.controller.d.ts.map +1 -1
- package/dist/foundations/how-to/controllers/how-to.controller.js +12 -0
- package/dist/foundations/how-to/controllers/how-to.controller.js.map +1 -1
- package/dist/foundations/role/controllers/role.controller.d.ts.map +1 -1
- package/dist/foundations/role/controllers/role.controller.js +8 -0
- package/dist/foundations/role/controllers/role.controller.js.map +1 -1
- package/dist/foundations/s3/controllers/s3.controller.d.ts +3 -8
- package/dist/foundations/s3/controllers/s3.controller.d.ts.map +1 -1
- package/dist/foundations/s3/controllers/s3.controller.js +10 -29
- package/dist/foundations/s3/controllers/s3.controller.js.map +1 -1
- package/dist/foundations/s3/index.d.ts +1 -0
- package/dist/foundations/s3/index.d.ts.map +1 -1
- package/dist/foundations/s3/index.js +1 -0
- package/dist/foundations/s3/index.js.map +1 -1
- package/dist/foundations/s3/s3.service.module.d.ts +2 -1
- package/dist/foundations/s3/s3.service.module.d.ts.map +1 -1
- package/dist/foundations/s3/s3.service.module.js +5 -3
- package/dist/foundations/s3/s3.service.module.js.map +1 -1
- package/dist/foundations/s3/services/s3-client-key.service.d.ts +64 -0
- package/dist/foundations/s3/services/s3-client-key.service.d.ts.map +1 -0
- package/dist/foundations/s3/services/s3-client-key.service.js +120 -0
- package/dist/foundations/s3/services/s3-client-key.service.js.map +1 -0
- package/dist/foundations/user/controllers/user.controller.d.ts +20 -2
- package/dist/foundations/user/controllers/user.controller.d.ts.map +1 -1
- package/dist/foundations/user/controllers/user.controller.js +89 -35
- package/dist/foundations/user/controllers/user.controller.js.map +1 -1
- package/dist/foundations/user/repositories/user.repository.d.ts +35 -0
- package/dist/foundations/user/repositories/user.repository.d.ts.map +1 -1
- package/dist/foundations/user/repositories/user.repository.js +60 -13
- package/dist/foundations/user/repositories/user.repository.js.map +1 -1
- package/dist/foundations/user/services/user.service.d.ts +21 -1
- package/dist/foundations/user/services/user.service.d.ts.map +1 -1
- package/dist/foundations/user/services/user.service.js +37 -3
- package/dist/foundations/user/services/user.service.js.map +1 -1
- package/package.json +1 -1
|
@@ -15,7 +15,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
15
15
|
exports.S3Controller = void 0;
|
|
16
16
|
const common_1 = require("@nestjs/common");
|
|
17
17
|
const config_1 = require("@nestjs/config");
|
|
18
|
-
const nestjs_cls_1 = require("nestjs-cls");
|
|
19
18
|
const stream_1 = require("stream");
|
|
20
19
|
const jwt_auth_guard_1 = require("../../../common/guards/jwt.auth.guard");
|
|
21
20
|
const s3_key_access_policy_interface_1 = require("../../../common/interfaces/s3.key-access.policy.interface");
|
|
@@ -23,20 +22,23 @@ const trusted_origins_resolver_interface_1 = require("../../../core/cors/interfa
|
|
|
23
22
|
const s3_cipher_core_1 = require("../../s3/cipher/s3-cipher.core");
|
|
24
23
|
const s3_meta_1 = require("../../s3/entities/s3.meta");
|
|
25
24
|
const s3_cipher_service_1 = require("../../s3/services/s3-cipher.service");
|
|
25
|
+
const s3_client_key_service_1 = require("../../s3/services/s3-client-key.service");
|
|
26
26
|
const s3_service_1 = require("../../s3/services/s3.service");
|
|
27
27
|
/** How long the browser keeps a file reached through a permanent (non-expiring) link. */
|
|
28
28
|
const PERMANENT_LINK_CACHE_SECONDS = 3600;
|
|
29
29
|
let S3Controller = class S3Controller {
|
|
30
|
-
constructor(service,
|
|
30
|
+
constructor(service, cipher, configService,
|
|
31
|
+
// Runs the bound S3_KEY_ACCESS_POLICY (400 on a malformed key, 403 on a refusal) for presign/sign/delete.
|
|
32
|
+
clientKeys, keyPolicy, trustedOrigins) {
|
|
31
33
|
this.service = service;
|
|
32
|
-
this.clsService = clsService;
|
|
33
34
|
this.cipher = cipher;
|
|
34
35
|
this.configService = configService;
|
|
36
|
+
this.clientKeys = clientKeys;
|
|
35
37
|
this.keyPolicy = keyPolicy;
|
|
36
38
|
this.trustedOrigins = trustedOrigins;
|
|
37
39
|
}
|
|
38
40
|
async getPresignedUrl(key, contentType, isPublic) {
|
|
39
|
-
await this.assertKeyAccess({ key, action: "upload", isPublic });
|
|
41
|
+
await this.clientKeys.assertKeyAccess({ key, action: "upload", isPublic });
|
|
40
42
|
return await this.service.generatePresignedUrl({
|
|
41
43
|
key: key,
|
|
42
44
|
contentType: contentType,
|
|
@@ -44,7 +46,7 @@ let S3Controller = class S3Controller {
|
|
|
44
46
|
});
|
|
45
47
|
}
|
|
46
48
|
async getSignedUrl(key, isPublic, filename) {
|
|
47
|
-
await this.assertKeyAccess({ key, action: "download", isPublic });
|
|
49
|
+
await this.clientKeys.assertKeyAccess({ key, action: "download", isPublic });
|
|
48
50
|
return await this.service.findSignedUrl({
|
|
49
51
|
key: key,
|
|
50
52
|
isPublic: isPublic,
|
|
@@ -52,30 +54,9 @@ let S3Controller = class S3Controller {
|
|
|
52
54
|
});
|
|
53
55
|
}
|
|
54
56
|
async deleteFile(key) {
|
|
55
|
-
await this.assertKeyAccess({ key, action: "delete", isPublic: false });
|
|
57
|
+
await this.clientKeys.assertKeyAccess({ key, action: "delete", isPublic: false });
|
|
56
58
|
await this.service.deleteFileFromS3({ key: key });
|
|
57
59
|
}
|
|
58
|
-
/**
|
|
59
|
-
* Rejects a malformed key (400) whether or not a policy is bound, then asks
|
|
60
|
-
* the bound policy, if any, and rejects a refusal (403).
|
|
61
|
-
*/
|
|
62
|
-
async assertKeyAccess(params) {
|
|
63
|
-
if (!(0, s3_key_access_policy_interface_1.isWellFormedS3Key)(params.key))
|
|
64
|
-
throw new common_1.BadRequestException("Invalid S3 key");
|
|
65
|
-
if (!this.keyPolicy)
|
|
66
|
-
return;
|
|
67
|
-
const allowed = await this.keyPolicy.canAccess({
|
|
68
|
-
key: params.key,
|
|
69
|
-
action: params.action,
|
|
70
|
-
// Query params arrive as strings: "true" is the only truthy value the clients send.
|
|
71
|
-
isPublic: params.isPublic === true || params.isPublic === "true",
|
|
72
|
-
userId: this.clsService.get("userId"),
|
|
73
|
-
companyId: this.clsService.get("companyId"),
|
|
74
|
-
roles: this.clsService.get("roles") ?? [],
|
|
75
|
-
});
|
|
76
|
-
if (!allowed)
|
|
77
|
-
throw new common_1.ForbiddenException("You cannot access this file.");
|
|
78
|
-
}
|
|
79
60
|
/**
|
|
80
61
|
* Token-authorised upload. The raw body arrives as a stream (see setupS3ObjectUploadStreaming);
|
|
81
62
|
* it is counted against the upload cap and streamed to storage, where S3Service encrypts it.
|
|
@@ -277,8 +258,8 @@ exports.S3Controller = S3Controller = __decorate([
|
|
|
277
258
|
__param(5, (0, common_1.Optional)()),
|
|
278
259
|
__param(5, (0, common_1.Inject)(trusted_origins_resolver_interface_1.TRUSTED_ORIGINS_RESOLVER)),
|
|
279
260
|
__metadata("design:paramtypes", [s3_service_1.S3Service,
|
|
280
|
-
nestjs_cls_1.ClsService,
|
|
281
261
|
s3_cipher_service_1.S3CipherService,
|
|
282
|
-
config_1.ConfigService,
|
|
262
|
+
config_1.ConfigService,
|
|
263
|
+
s3_client_key_service_1.S3ClientKeyService, Object, Object])
|
|
283
264
|
], S3Controller);
|
|
284
265
|
//# sourceMappingURL=s3.controller.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"s3.controller.js","sourceRoot":"","sources":["../../../../src/foundations/s3/controllers/s3.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAmBwB;AACxB,2CAA+C;AAE/C,
|
|
1
|
+
{"version":3,"file":"s3.controller.js","sourceRoot":"","sources":["../../../../src/foundations/s3/controllers/s3.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAmBwB;AACxB,2CAA+C;AAE/C,mCAA6C;AAE7C,0EAAqE;AACrE,8GAImE;AAEnE,yHAG0E;AAE1E,mEAKwC;AACxC,uDAAuE;AACvE,2EAAsE;AACtE,mFAA6E;AAC7E,6DAAyD;AAEzD,yFAAyF;AACzF,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAGnC,IAAM,YAAY,GAAlB,MAAM,YAAY;IACvB,YACmB,OAAkB,EAClB,MAAuB,EACvB,aAAiD;IAClE,0GAA0G;IACzF,UAA8B,EAG9B,SAA6B,EAK7B,cAAuC;QAZvC,YAAO,GAAP,OAAO,CAAW;QAClB,WAAM,GAAN,MAAM,CAAiB;QACvB,kBAAa,GAAb,aAAa,CAAoC;QAEjD,eAAU,GAAV,UAAU,CAAoB;QAG9B,cAAS,GAAT,SAAS,CAAoB;QAK7B,mBAAc,GAAd,cAAc,CAAyB;IACvD,CAAC;IAIE,AAAN,KAAK,CAAC,eAAe,CACL,GAAW,EACH,WAAmB,EACtB,QAAiB;QAEpC,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE3E,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;YAC7C,GAAG,EAAE,GAAG;YACR,WAAW,EAAE,WAAW;YACxB,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAIK,AAAN,KAAK,CAAC,YAAY,CACF,GAAW,EACN,QAAiB,EACjB,QAAiB;QAEpC,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE7E,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;YACtC,GAAG,EAAE,GAAG;YACR,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAKK,AAAN,KAAK,CAAC,UAAU,CAAe,GAAW;QACxC,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAElF,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAED;;;OAGG;IAEG,AAAN,KAAK,CAAC,SAAS,CACN,GAAmB,EACnB,KAAmB,EACV,KAAa;QAE7B,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAEhD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC;QAC7E,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,OAAO,GAAG,IAAI,kBAAS,CAAC;YAC5B,SAAS,CAAC,KAAa,EAAE,SAAS,EAAE,QAAQ;gBAC1C,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC;gBACzB,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;oBACxB,QAAQ,GAAG,IAAI,CAAC;oBAChB,QAAQ,CAAC,IAAI,iCAAwB,CAAC,kBAAkB,QAAQ,QAAQ,CAAC,CAAC,CAAC;oBAC3E,OAAO;gBACT,CAAC;gBACD,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACxB,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,GAAG,CAAC,IAAgB,CAAC;QAClC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACrB,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEnB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;gBAC9B,GAAG,EAAE,OAAO,CAAC,CAAC;gBACd,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,0BAA0B;gBACpD,MAAM,EAAE,OAAO;aAChB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,QAAQ;gBAAE,MAAM,IAAI,iCAAwB,CAAC,kBAAkB,QAAQ,QAAQ,CAAC,CAAC;YACrF,MAAM,KAAK,CAAC;QACd,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IAEG,AAAN,KAAK,CAAC,SAAS,CAAQ,KAAmB,EAAkB,KAAa;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAEhD,IAAI,MAAwD,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,wCAAuB;gBAAE,MAAM,IAAI,qCAA4B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpG,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,IAAI,0BAA0B,CAAC,CAAC;QAC/E,KAAK,CAAC,MAAM,CACV,qBAAqB,EACrB,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC;YACpB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,gCAAgC,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1D,CAAC,CAAC,OAAO,CAAC,CAAC;gBACT,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,CACvD,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAEtC,iGAAiG;QACjG,mGAAmG;QACnG,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QACpD,IAAI,cAAc,EAAE,CAAC;YACnB,KAAK,CAAC,MAAM,CAAC,yBAAyB,EAAE,mBAAmB,cAAc,EAAE,CAAC,CAAC;YAC7E,KAAK,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC;QACxC,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACK,aAAa,CAAC,OAA6B;QACjD,IAAI,OAAO,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO,oBAAoB,4BAA4B,EAAE,CAAC;QACvF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QACzE,OAAO,oBAAoB,SAAS,EAAE,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,eAAe;QAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACpC,IAAI,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEvC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,wEAAwE,EAAE,KAAK,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACzG,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;IAEO,UAAU;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAqB,KAAK,CAAC,EAAE,GAAG,CAAC;QACnE,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAE3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YACnC,OAAO,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,KAAa,EAAE,EAAmB;QACrD,IAAI,OAA6B,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mCAAkB;gBAAE,MAAM,IAAI,8BAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACxF,MAAM,KAAK,CAAC;QACd,CAAC;QACD,gGAAgG;QAChG,IAAI,CAAC,IAAA,kDAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,4BAAmB,CAAC,gBAAgB,CAAC,CAAC;QACnF,0FAA0F;QAC1F,IAAI,IAAI,CAAC,SAAS,EAAE,aAAa,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3E,MAAM,IAAI,2BAAkB,CAAC,gCAAgC,CAAC,CAAC;QACjE,gGAAgG;QAChG,8EAA8E;QAC9E,IACE,EAAE,KAAK,KAAK;YACZ,OAAO,CAAC,CAAC,KAAK,SAAS;YACvB,IAAI,CAAC,SAAS,EAAE,cAAc;YAC9B,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;YAEzC,MAAM,IAAI,8BAAqB,CAAC,iDAAiD,CAAC,CAAC;QACrF,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAA;AA3NY,oCAAY;AAmBjB;IAFL,IAAA,kBAAS,EAAC,6BAAY,CAAC;IACvB,IAAA,YAAG,GAAE;IAEH,WAAA,IAAA,cAAK,EAAC,KAAK,CAAC,CAAA;IACZ,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IACpB,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;;;;mDASnB;AAIK;IAFL,IAAA,kBAAS,EAAC,6BAAY,CAAC;IACvB,IAAA,YAAG,EAAC,MAAM,CAAC;IAET,WAAA,IAAA,cAAK,EAAC,KAAK,CAAC,CAAA;IACZ,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IACjB,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;;;;gDASnB;AAKK;IAHL,IAAA,kBAAS,EAAC,6BAAY,CAAC;IACvB,IAAA,eAAM,GAAE;IACR,IAAA,iBAAQ,EAAC,mBAAU,CAAC,UAAU,CAAC;IACd,WAAA,IAAA,cAAK,EAAC,KAAK,CAAC,CAAA;;;;8CAI7B;AAOK;IADL,IAAA,YAAG,EAAC,GAAG,4BAAkB,SAAS,CAAC;IAEjC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;;;;6CAuChB;AAMK;IADL,IAAA,YAAG,EAAC,GAAG,4BAAkB,SAAS,CAAC;IACnB,WAAA,IAAA,YAAG,GAAE,CAAA;IAAuB,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;;;;6CAoC1D;uBAnJU,YAAY;IADxB,IAAA,mBAAU,EAAC,gBAAM,CAAC,QAAQ,CAAC;IAQvB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,qDAAoB,CAAC,CAAA;IAI5B,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,6DAAwB,CAAC,CAAA;qCAXP,sBAAS;QACV,mCAAe;QACR,sBAAa;QAEhB,0CAAkB;GANtC,YAAY,CA2NxB"}
|
|
@@ -2,6 +2,7 @@ export * from "./s3.module";
|
|
|
2
2
|
export * from "./s3.service.module";
|
|
3
3
|
export * from "./services/s3.service";
|
|
4
4
|
export * from "./services/s3-cipher.service";
|
|
5
|
+
export * from "./services/s3-client-key.service";
|
|
5
6
|
export * from "./cipher";
|
|
6
7
|
export * from "./serialisers/s3.serialiser";
|
|
7
8
|
export * from "./controllers/s3.controller";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/foundations/s3/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,UAAU,CAAC;AACzB,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/foundations/s3/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kCAAkC,CAAC;AACjD,cAAc,UAAU,CAAC;AACzB,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC"}
|
|
@@ -18,6 +18,7 @@ __exportStar(require("./s3.module"), exports);
|
|
|
18
18
|
__exportStar(require("./s3.service.module"), exports);
|
|
19
19
|
__exportStar(require("./services/s3.service"), exports);
|
|
20
20
|
__exportStar(require("./services/s3-cipher.service"), exports);
|
|
21
|
+
__exportStar(require("./services/s3-client-key.service"), exports);
|
|
21
22
|
__exportStar(require("./cipher"), exports);
|
|
22
23
|
__exportStar(require("./serialisers/s3.serialiser"), exports);
|
|
23
24
|
__exportStar(require("./controllers/s3.controller"), exports);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/foundations/s3/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAA4B;AAC5B,sDAAoC;AACpC,wDAAsC;AACtC,+DAA6C;AAC7C,2CAAyB;AACzB,8DAA4C;AAC5C,8DAA4C;AAC5C,uDAAqC;AACrC,qDAAmC;AACnC,sDAAoC;AACpC,oDAAkC;AAClC,mDAAiC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/foundations/s3/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAA4B;AAC5B,sDAAoC;AACpC,wDAAsC;AACtC,+DAA6C;AAC7C,mEAAiD;AACjD,2CAAyB;AACzB,8DAA4C;AAC5C,8DAA4C;AAC5C,uDAAqC;AACrC,qDAAmC;AACnC,sDAAoC;AACpC,oDAAkC;AAClC,mDAAiC"}
|
|
@@ -1,7 +1,8 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* S3 Service Module
|
|
3
3
|
*
|
|
4
|
-
* Provides S3Service (and the S3CipherService it depends on) and
|
|
4
|
+
* Provides S3Service (and the S3CipherService it depends on) and S3ClientKeyService (the S3 key access
|
|
5
|
+
* check for client-supplied keys) and NOTHING else — no controller, no serialiser.
|
|
5
6
|
*
|
|
6
7
|
* WHY THIS EXISTS: S3Service used to be registered TWICE — once by S3Module,
|
|
7
8
|
* and once directly in MigratorModule's `providers` (so the migrator could
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"s3.service.module.d.ts","sourceRoot":"","sources":["../../../src/foundations/s3/s3.service.module.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"s3.service.module.d.ts","sourceRoot":"","sources":["../../../src/foundations/s3/s3.service.module.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBAIa,eAAe;CAAG"}
|
|
@@ -9,11 +9,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
9
9
|
exports.S3ServiceModule = void 0;
|
|
10
10
|
const common_1 = require("@nestjs/common");
|
|
11
11
|
const s3_cipher_service_1 = require("./services/s3-cipher.service");
|
|
12
|
+
const s3_client_key_service_1 = require("./services/s3-client-key.service");
|
|
12
13
|
const s3_service_1 = require("./services/s3.service");
|
|
13
14
|
/**
|
|
14
15
|
* S3 Service Module
|
|
15
16
|
*
|
|
16
|
-
* Provides S3Service (and the S3CipherService it depends on) and
|
|
17
|
+
* Provides S3Service (and the S3CipherService it depends on) and S3ClientKeyService (the S3 key access
|
|
18
|
+
* check for client-supplied keys) and NOTHING else — no controller, no serialiser.
|
|
17
19
|
*
|
|
18
20
|
* WHY THIS EXISTS: S3Service used to be registered TWICE — once by S3Module,
|
|
19
21
|
* and once directly in MigratorModule's `providers` (so the migrator could
|
|
@@ -42,8 +44,8 @@ let S3ServiceModule = class S3ServiceModule {
|
|
|
42
44
|
exports.S3ServiceModule = S3ServiceModule;
|
|
43
45
|
exports.S3ServiceModule = S3ServiceModule = __decorate([
|
|
44
46
|
(0, common_1.Module)({
|
|
45
|
-
providers: [s3_service_1.S3Service, s3_cipher_service_1.S3CipherService],
|
|
46
|
-
exports: [s3_service_1.S3Service, s3_cipher_service_1.S3CipherService],
|
|
47
|
+
providers: [s3_service_1.S3Service, s3_cipher_service_1.S3CipherService, s3_client_key_service_1.S3ClientKeyService],
|
|
48
|
+
exports: [s3_service_1.S3Service, s3_cipher_service_1.S3CipherService, s3_client_key_service_1.S3ClientKeyService],
|
|
47
49
|
})
|
|
48
50
|
], S3ServiceModule);
|
|
49
51
|
//# sourceMappingURL=s3.service.module.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"s3.service.module.js","sourceRoot":"","sources":["../../../src/foundations/s3/s3.service.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,oEAA+D;AAC/D,sDAAkD;AAElD
|
|
1
|
+
{"version":3,"file":"s3.service.module.js","sourceRoot":"","sources":["../../../src/foundations/s3/s3.service.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,oEAA+D;AAC/D,4EAAsE;AACtE,sDAAkD;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAKI,IAAM,eAAe,GAArB,MAAM,eAAe;CAAG,CAAA;AAAlB,0CAAe;0BAAf,eAAe;IAJ3B,IAAA,eAAM,EAAC;QACN,SAAS,EAAE,CAAC,sBAAS,EAAE,mCAAe,EAAE,0CAAkB,CAAC;QAC3D,OAAO,EAAE,CAAC,sBAAS,EAAE,mCAAe,EAAE,0CAAkB,CAAC;KAC1D,CAAC;GACW,eAAe,CAAG"}
|
|
@@ -0,0 +1,64 @@
|
|
|
1
|
+
import { ClsService } from "nestjs-cls";
|
|
2
|
+
import { S3KeyAccessPolicy, S3KeyAction } from "../../../common/interfaces/s3.key-access.policy.interface";
|
|
3
|
+
/**
|
|
4
|
+
* Runs the bound `S3_KEY_ACCESS_POLICY` on an object key for the current
|
|
5
|
+
* caller (`userId`, `companyId` and `roles` from the request CLS context, the
|
|
6
|
+
* same values the repositories scope by).
|
|
7
|
+
*
|
|
8
|
+
* Two entry points:
|
|
9
|
+
*
|
|
10
|
+
* - `assertKeyAccess` — the `/s3` routes (presign, sign, delete). A malformed
|
|
11
|
+
* key is refused (400) whether or not a policy is bound.
|
|
12
|
+
* - `assertClientKey` — a key the CLIENT sent in a request body (an avatar, a
|
|
13
|
+
* logo, an uploaded file the entity will point at), run by a service before
|
|
14
|
+
* the key is stored or read server-side.
|
|
15
|
+
*
|
|
16
|
+
* When no policy is bound, `assertClientKey` allows every value, exactly as
|
|
17
|
+
* before the check existed: an application that wants body keys checked binds
|
|
18
|
+
* `S3_KEY_ACCESS_POLICY`.
|
|
19
|
+
*/
|
|
20
|
+
export declare class S3ClientKeyService {
|
|
21
|
+
private readonly clsService;
|
|
22
|
+
private readonly keyPolicy?;
|
|
23
|
+
constructor(clsService: ClsService, keyPolicy?: S3KeyAccessPolicy);
|
|
24
|
+
/**
|
|
25
|
+
* Rejects a malformed key (400) whether or not a policy is bound, then asks
|
|
26
|
+
* the bound policy, if any, and rejects a refusal (403).
|
|
27
|
+
*/
|
|
28
|
+
assertKeyAccess(params: {
|
|
29
|
+
key: unknown;
|
|
30
|
+
action: S3KeyAction;
|
|
31
|
+
isPublic: boolean | string | undefined;
|
|
32
|
+
}): Promise<void>;
|
|
33
|
+
/**
|
|
34
|
+
* Service-side check for a key the CLIENT sent in a request body (a
|
|
35
|
+
* document url, an avatar, a logo, an uploaded file…), run before the key is
|
|
36
|
+
* stored or read. The stored key is later signed for whoever reads the
|
|
37
|
+
* entity, so a key the caller may not download must never be accepted.
|
|
38
|
+
*
|
|
39
|
+
* Absent values pass (nothing to check). An absolute http(s) URL is not an
|
|
40
|
+
* S3 key and passes untouched: the callers already branch on it, or store
|
|
41
|
+
* it as a literal link (the web user editor sends back the signed avatar
|
|
42
|
+
* URL it was given).
|
|
43
|
+
*
|
|
44
|
+
* No policy bound: every value passes, as before (see the class comment).
|
|
45
|
+
*
|
|
46
|
+
* Otherwise a malformed key (`isWellFormedS3Key`) is refused with a 400,
|
|
47
|
+
* and the bound policy decides with `action` (default `download`, since the
|
|
48
|
+
* stored key is signed for every reader) and `isPublic: false`; a refusal
|
|
49
|
+
* is a 403.
|
|
50
|
+
*
|
|
51
|
+
* `folder` is set by the avatar / image / logo fields: the key must then sit
|
|
52
|
+
* in that field's own folder, `companies/<cid>/<folder>/…` (`users` for the
|
|
53
|
+
* avatar, `companies` for the logo), so such a field cannot point at another
|
|
54
|
+
* kind of file (a recording, an export) of the same company. No
|
|
55
|
+
* Administrator bypass on the folder; the policy still decides the company.
|
|
56
|
+
*/
|
|
57
|
+
assertClientKey(params: {
|
|
58
|
+
key: string | null | undefined;
|
|
59
|
+
action?: S3KeyAction;
|
|
60
|
+
folder?: string;
|
|
61
|
+
}): Promise<void>;
|
|
62
|
+
private _canAccess;
|
|
63
|
+
}
|
|
64
|
+
//# sourceMappingURL=s3-client-key.service.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"s3-client-key.service.d.ts","sourceRoot":"","sources":["../../../../src/foundations/s3/services/s3-client-key.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAGL,iBAAiB,EACjB,WAAW,EACZ,MAAM,2DAA2D,CAAC;AAEnE;;;;;;;;;;;;;;;;GAgBG;AACH,qBACa,kBAAkB;IAE3B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAG3B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAHV,UAAU,EAAE,UAAU,EAGtB,SAAS,CAAC,EAAE,iBAAiB;IAGhD;;;OAGG;IACG,eAAe,CAAC,MAAM,EAAE;QAC5B,GAAG,EAAE,OAAO,CAAC;QACb,MAAM,EAAE,WAAW,CAAC;QACpB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;KACxC,GAAG,OAAO,CAAC,IAAI,CAAC;IAejB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,eAAe,CAAC,MAAM,EAAE;QAC5B,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;QAC/B,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC;YAoBH,UAAU;CAUzB"}
|
|
@@ -0,0 +1,120 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
|
|
3
|
+
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
|
|
4
|
+
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
|
|
5
|
+
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
|
|
6
|
+
return c > 3 && r && Object.defineProperty(target, key, r), r;
|
|
7
|
+
};
|
|
8
|
+
var __metadata = (this && this.__metadata) || function (k, v) {
|
|
9
|
+
if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
|
|
10
|
+
};
|
|
11
|
+
var __param = (this && this.__param) || function (paramIndex, decorator) {
|
|
12
|
+
return function (target, key) { decorator(target, key, paramIndex); }
|
|
13
|
+
};
|
|
14
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
15
|
+
exports.S3ClientKeyService = void 0;
|
|
16
|
+
const common_1 = require("@nestjs/common");
|
|
17
|
+
const nestjs_cls_1 = require("nestjs-cls");
|
|
18
|
+
const s3_key_access_policy_interface_1 = require("../../../common/interfaces/s3.key-access.policy.interface");
|
|
19
|
+
/**
|
|
20
|
+
* Runs the bound `S3_KEY_ACCESS_POLICY` on an object key for the current
|
|
21
|
+
* caller (`userId`, `companyId` and `roles` from the request CLS context, the
|
|
22
|
+
* same values the repositories scope by).
|
|
23
|
+
*
|
|
24
|
+
* Two entry points:
|
|
25
|
+
*
|
|
26
|
+
* - `assertKeyAccess` — the `/s3` routes (presign, sign, delete). A malformed
|
|
27
|
+
* key is refused (400) whether or not a policy is bound.
|
|
28
|
+
* - `assertClientKey` — a key the CLIENT sent in a request body (an avatar, a
|
|
29
|
+
* logo, an uploaded file the entity will point at), run by a service before
|
|
30
|
+
* the key is stored or read server-side.
|
|
31
|
+
*
|
|
32
|
+
* When no policy is bound, `assertClientKey` allows every value, exactly as
|
|
33
|
+
* before the check existed: an application that wants body keys checked binds
|
|
34
|
+
* `S3_KEY_ACCESS_POLICY`.
|
|
35
|
+
*/
|
|
36
|
+
let S3ClientKeyService = class S3ClientKeyService {
|
|
37
|
+
constructor(clsService, keyPolicy) {
|
|
38
|
+
this.clsService = clsService;
|
|
39
|
+
this.keyPolicy = keyPolicy;
|
|
40
|
+
}
|
|
41
|
+
/**
|
|
42
|
+
* Rejects a malformed key (400) whether or not a policy is bound, then asks
|
|
43
|
+
* the bound policy, if any, and rejects a refusal (403).
|
|
44
|
+
*/
|
|
45
|
+
async assertKeyAccess(params) {
|
|
46
|
+
if (!(0, s3_key_access_policy_interface_1.isWellFormedS3Key)(params.key))
|
|
47
|
+
throw new common_1.BadRequestException("Invalid S3 key");
|
|
48
|
+
if (!this.keyPolicy)
|
|
49
|
+
return;
|
|
50
|
+
const allowed = await this._canAccess({
|
|
51
|
+
key: params.key,
|
|
52
|
+
action: params.action,
|
|
53
|
+
// Query params arrive as strings: "true" is the only truthy value the clients send.
|
|
54
|
+
isPublic: params.isPublic === true || params.isPublic === "true",
|
|
55
|
+
});
|
|
56
|
+
if (!allowed)
|
|
57
|
+
throw new common_1.ForbiddenException("You cannot access this file.");
|
|
58
|
+
}
|
|
59
|
+
/**
|
|
60
|
+
* Service-side check for a key the CLIENT sent in a request body (a
|
|
61
|
+
* document url, an avatar, a logo, an uploaded file…), run before the key is
|
|
62
|
+
* stored or read. The stored key is later signed for whoever reads the
|
|
63
|
+
* entity, so a key the caller may not download must never be accepted.
|
|
64
|
+
*
|
|
65
|
+
* Absent values pass (nothing to check). An absolute http(s) URL is not an
|
|
66
|
+
* S3 key and passes untouched: the callers already branch on it, or store
|
|
67
|
+
* it as a literal link (the web user editor sends back the signed avatar
|
|
68
|
+
* URL it was given).
|
|
69
|
+
*
|
|
70
|
+
* No policy bound: every value passes, as before (see the class comment).
|
|
71
|
+
*
|
|
72
|
+
* Otherwise a malformed key (`isWellFormedS3Key`) is refused with a 400,
|
|
73
|
+
* and the bound policy decides with `action` (default `download`, since the
|
|
74
|
+
* stored key is signed for every reader) and `isPublic: false`; a refusal
|
|
75
|
+
* is a 403.
|
|
76
|
+
*
|
|
77
|
+
* `folder` is set by the avatar / image / logo fields: the key must then sit
|
|
78
|
+
* in that field's own folder, `companies/<cid>/<folder>/…` (`users` for the
|
|
79
|
+
* avatar, `companies` for the logo), so such a field cannot point at another
|
|
80
|
+
* kind of file (a recording, an export) of the same company. No
|
|
81
|
+
* Administrator bypass on the folder; the policy still decides the company.
|
|
82
|
+
*/
|
|
83
|
+
async assertClientKey(params) {
|
|
84
|
+
const key = params.key;
|
|
85
|
+
if (key === undefined || key === null || key === "")
|
|
86
|
+
return;
|
|
87
|
+
if (/^https?:\/\//i.test(key))
|
|
88
|
+
return;
|
|
89
|
+
if (!this.keyPolicy)
|
|
90
|
+
return;
|
|
91
|
+
if (!(0, s3_key_access_policy_interface_1.isWellFormedS3Key)(key))
|
|
92
|
+
throw new common_1.BadRequestException("Invalid S3 key");
|
|
93
|
+
if (params.folder !== undefined) {
|
|
94
|
+
const segments = key.split("/");
|
|
95
|
+
if (segments[0] !== "companies" || segments[2] !== params.folder || segments.length < 5)
|
|
96
|
+
throw new common_1.ForbiddenException("You cannot reference this file.");
|
|
97
|
+
}
|
|
98
|
+
const allowed = await this._canAccess({ key, action: params.action ?? "download", isPublic: false });
|
|
99
|
+
if (!allowed)
|
|
100
|
+
throw new common_1.ForbiddenException("You cannot reference this file.");
|
|
101
|
+
}
|
|
102
|
+
async _canAccess(params) {
|
|
103
|
+
return await this.keyPolicy.canAccess({
|
|
104
|
+
key: params.key,
|
|
105
|
+
action: params.action,
|
|
106
|
+
isPublic: params.isPublic,
|
|
107
|
+
userId: this.clsService.get("userId"),
|
|
108
|
+
companyId: this.clsService.get("companyId"),
|
|
109
|
+
roles: this.clsService.get("roles") ?? [],
|
|
110
|
+
});
|
|
111
|
+
}
|
|
112
|
+
};
|
|
113
|
+
exports.S3ClientKeyService = S3ClientKeyService;
|
|
114
|
+
exports.S3ClientKeyService = S3ClientKeyService = __decorate([
|
|
115
|
+
(0, common_1.Injectable)(),
|
|
116
|
+
__param(1, (0, common_1.Optional)()),
|
|
117
|
+
__param(1, (0, common_1.Inject)(s3_key_access_policy_interface_1.S3_KEY_ACCESS_POLICY)),
|
|
118
|
+
__metadata("design:paramtypes", [nestjs_cls_1.ClsService, Object])
|
|
119
|
+
], S3ClientKeyService);
|
|
120
|
+
//# sourceMappingURL=s3-client-key.service.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"s3-client-key.service.js","sourceRoot":"","sources":["../../../../src/foundations/s3/services/s3-client-key.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAuG;AACvG,2CAAwC;AACxC,8GAKmE;AAEnE;;;;;;;;;;;;;;;;GAgBG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAC7B,YACmB,UAAsB,EAGtB,SAA6B;QAH7B,eAAU,GAAV,UAAU,CAAY;QAGtB,cAAS,GAAT,SAAS,CAAoB;IAC7C,CAAC;IAEJ;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,MAIrB;QACC,IAAI,CAAC,IAAA,kDAAiB,EAAC,MAAM,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,4BAAmB,CAAC,gBAAgB,CAAC,CAAC;QAEpF,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAE5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC;YACpC,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,oFAAoF;YACpF,QAAQ,EAAE,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM;SACjE,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,2BAAkB,CAAC,8BAA8B,CAAC,CAAC;IAC7E,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CAAC,eAAe,CAAC,MAIrB;QACC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO;QAC5D,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO;QAEtC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAE5B,IAAI,CAAC,IAAA,kDAAiB,EAAC,GAAG,CAAC;YAAE,MAAM,IAAI,4BAAmB,CAAC,gBAAgB,CAAC,CAAC;QAE7E,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;gBACrF,MAAM,IAAI,2BAAkB,CAAC,iCAAiC,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAErG,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,2BAAkB,CAAC,iCAAiC,CAAC,CAAC;IAChF,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,MAA+D;QACtF,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;YACpC,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;YACrC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC;YAC3C,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;SAC1C,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAzFY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;IAIR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,qDAAoB,CAAC,CAAA;qCAFA,uBAAU;GAF9B,kBAAkB,CAyF9B"}
|
|
@@ -22,12 +22,21 @@ export declare class UserController {
|
|
|
22
22
|
private readonly relevancyService;
|
|
23
23
|
private readonly cypherService;
|
|
24
24
|
constructor(users: UserService, security: SecurityService, companyService: CompanyService, cacheService: CacheService, clsService: ClsService, relevancyService: RelevancyService<User>, cypherService: UserCypherService);
|
|
25
|
+
/** Platform administrator: the global Administrator role. */
|
|
26
|
+
private isPlatformAdmin;
|
|
27
|
+
/** Administrator OR CompanyAdministrator. */
|
|
28
|
+
private isAnyAdmin;
|
|
25
29
|
findBySearch(request: AuthenticatedRequest, reply: FastifyReply, query: any, search?: string, includeDeleted?: boolean, contentIds?: string): Promise<void>;
|
|
26
30
|
findOneByUserId(req: any, userId: string): Promise<import("../../..").JsonApiSingleDocument>;
|
|
27
31
|
findFullUser(request: AuthenticatedRequest, reply: FastifyReply): Promise<void>;
|
|
28
|
-
|
|
32
|
+
/**
|
|
33
|
+
* Admin lookup (the user editor's duplicate-email check). Bound to the
|
|
34
|
+
* caller's company: a user of another company answers 404, like a missing
|
|
35
|
+
* one. Only a platform administrator looks up across companies.
|
|
36
|
+
*/
|
|
37
|
+
findOneByEmail(request: AuthenticatedRequest, email: string): Promise<import("../../..").JsonApiSingleDocument>;
|
|
29
38
|
findByCompany(request: AuthenticatedRequest, reply: FastifyReply, companyId: string, query: any, search?: string, includeDeleted?: boolean, isDeleted?: boolean): Promise<void>;
|
|
30
|
-
createUser(request: any, body: UserPostDTO, reply: FastifyReply, lng?: string): Promise<
|
|
39
|
+
createUser(request: any, body: UserPostDTO, reply: FastifyReply, lng?: string): Promise<void>;
|
|
31
40
|
put(request: any, userId: string, body: UserPutDTO, reply: FastifyReply): Promise<void>;
|
|
32
41
|
reactivateUser(request: any, userId: string, reply: FastifyReply): Promise<void>;
|
|
33
42
|
updateUserAvatar(request: any, userId: string, body: UserPatchAvatarDTO, reply: FastifyReply): Promise<void>;
|
|
@@ -40,6 +49,15 @@ export declare class UserController {
|
|
|
40
49
|
sendInvitationEmail(request: any, userId: string): Promise<void>;
|
|
41
50
|
delete(request: any, userId: string): Promise<void>;
|
|
42
51
|
findUserByRole(req: any, query: any, roleId: string, notInRole?: boolean, search?: string): Promise<import("../../..").JsonApiListDocument>;
|
|
52
|
+
/**
|
|
53
|
+
* Role grants are never self-service.
|
|
54
|
+
* - Administrator is a PLATFORM grant: only a platform administrator may
|
|
55
|
+
* give or take it.
|
|
56
|
+
* - Any other role: Administrator or CompanyAdministrator. A
|
|
57
|
+
* CompanyAdministrator acts inside their CLS company only; the repository
|
|
58
|
+
* matches the target user through BELONGS_TO that company.
|
|
59
|
+
*/
|
|
60
|
+
private assertCanManageRole;
|
|
43
61
|
addUserToRole(req: any, roleId: string, userId: string, reply: FastifyReply): Promise<void>;
|
|
44
62
|
removeUserToRole(req: any, roleId: string, userId: string): Promise<void>;
|
|
45
63
|
findContentsRelevantForContent(query: any, contentId: string): Promise<import("../../..").JsonApiListDocument>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"user.controller.d.ts","sourceRoot":"","sources":["../../../../src/foundations/user/controllers/user.controller.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,eAAe,EAAE,MAAM,kDAAkD,CAAC;AAEnF,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4DAA4D,CAAC;AAClG,OAAO,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAG1E,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4CAA4C,CAAC;AAE9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAE1D,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,qBAEa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,aAAa;gBANb,KAAK,EAAE,WAAW,EAClB,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,gBAAgB,CAAC,IAAI,CAAC,EACxC,aAAa,EAAE,iBAAiB;
|
|
1
|
+
{"version":3,"file":"user.controller.d.ts","sourceRoot":"","sources":["../../../../src/foundations/user/controllers/user.controller.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,eAAe,EAAE,MAAM,kDAAkD,CAAC;AAEnF,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4DAA4D,CAAC;AAClG,OAAO,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAG1E,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4CAA4C,CAAC;AAE9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAE1D,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,qBAEa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,aAAa;gBANb,KAAK,EAAE,WAAW,EAClB,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,gBAAgB,CAAC,IAAI,CAAC,EACxC,aAAa,EAAE,iBAAiB;IAGnD,6DAA6D;IAC7D,OAAO,CAAC,eAAe;IAIvB,6CAA6C;IAC7C,OAAO,CAAC,UAAU;IAQZ,YAAY,CACT,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,YAAY,EACjB,KAAK,EAAE,GAAG,EACF,MAAM,CAAC,EAAE,MAAM,EACP,cAAc,CAAC,EAAE,OAAO,EAC5B,UAAU,CAAC,EAAE,MAAM;IAuBpC,eAAe,CAAY,GAAG,EAAE,GAAG,EAAmB,MAAM,EAAE,MAAM;IAYpE,YAAY,CAAQ,OAAO,EAAE,oBAAoB,EAAS,KAAK,EAAE,YAAY;IAUnF;;;;OAIG;IAGG,cAAc,CAAQ,OAAO,EAAE,oBAAoB,EAAkB,KAAK,EAAE,MAAM;IAUlF,aAAa,CACV,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,YAAY,EACN,SAAS,EAAE,MAAM,EAC5B,KAAK,EAAE,GAAG,EACF,MAAM,CAAC,EAAE,MAAM,EACP,cAAc,CAAC,EAAE,OAAO,EAC7B,SAAS,CAAC,EAAE,OAAO;IAuBnC,UAAU,CACP,OAAO,EAAE,GAAG,EACX,IAAI,EAAE,WAAW,EAClB,KAAK,EAAE,YAAY,EACZ,GAAG,CAAC,EAAE,MAAM;IAwCtB,GAAG,CACI,OAAO,EAAE,GAAG,EACN,MAAM,EAAE,MAAM,EACvB,IAAI,EAAE,UAAU,EACjB,KAAK,EAAE,YAAY;IAkBtB,cAAc,CAAY,OAAO,EAAE,GAAG,EAAmB,MAAM,EAAE,MAAM,EAAS,KAAK,EAAE,YAAY;IAanG,gBAAgB,CACT,OAAO,EAAE,GAAG,EACN,MAAM,EAAE,MAAM,EACvB,IAAI,EAAE,kBAAkB,EACzB,KAAK,EAAE,YAAY;IAU5B;;;OAGG;IAIG,kBAAkB,CACX,OAAO,EAAE,GAAG,EACN,MAAM,EAAE,MAAM,EACvB,IAAI,EAAE,oBAAoB,EAC3B,KAAK,EAAE,YAAY;IAetB,eAAe,CACR,OAAO,EAAE,GAAG,EACN,MAAM,EAAE,MAAM,EACvB,IAAI,EAAE,gBAAgB,EACvB,KAAK,EAAE,YAAY;IAYtB,mBAAmB,CAAY,OAAO,EAAE,GAAG,EAAmB,MAAM,EAAE,MAAM;IAQ5E,MAAM,CAAQ,OAAO,EAAE,GAAG,EAAmB,MAAM,EAAE,MAAM;IAY3D,cAAc,CACP,GAAG,EAAE,GAAG,EACV,KAAK,EAAE,GAAG,EACF,MAAM,EAAE,MAAM,EACX,SAAS,CAAC,EAAE,OAAO,EACtB,MAAM,CAAC,EAAE,MAAM;IAsBlC;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB;IAerB,aAAa,CACN,GAAG,EAAE,GAAG,EACF,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACxB,KAAK,EAAE,YAAY;IAiBtB,gBAAgB,CAAY,GAAG,EAAE,GAAG,EAAmB,MAAM,EAAE,MAAM,EAAmB,MAAM,EAAE,MAAM;IActG,8BAA8B,CAAU,KAAK,EAAE,GAAG,EAAsB,SAAS,EAAE,MAAM;CAOhG"}
|