@cryptexlabs/codex-nodejs-common 0.1.16 → 0.1.20

package/lib/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@cryptexlabs/codex-nodejs-common",
-    "version": "0.1.16",
+    "version": "0.1.20",
     "description": "Common code for Assistant applications",
     "main": "lib/src/index.js",
     "repository": "git@gitlab.com:cryptexlabs/public/codex-nodejs-common.git",

package/lib/src/auth/authorization-allowance.d.ts

@@ -6,5 +6,4 @@ export declare class AuthorizationAllowance {
     private readonly action;
     constructor(subject: any, object: any, objectId: any, action: any);
     isRequestAllowed(request: AuthorizationRequestInterface): boolean;
-    private _isRequestingSelf;
 }

package/lib/src/auth/authorization-allowance.js

@@ -22,8 +22,7 @@ class AuthorizationAllowance {
             this.objectId &&
             this.objectId.toString().trim() !== "") {
             if (this.objectId !== "any" &&
-                request.objectId.toString() !== this.objectId.toString() &&
-                !this._isRequestingSelf(request)) {
+                request.objectId.toString() !== this.objectId.toString()) {
                 return false;
             }
         }
@@ -37,11 +36,6 @@ class AuthorizationAllowance {
         }
         return true;
     }
-    _isRequestingSelf(request) {
-        return (request.object === "user" &&
-            request.objectId.toString() === this.subject.toString() &&
-            this.objectId === "self");
-    }
 }
 exports.AuthorizationAllowance = AuthorizationAllowance;
 //# sourceMappingURL=authorization-allowance.js.map

package/lib/src/auth/authorization-allowance.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-allowance.js","sourceRoot":"","sources":["../../../src/auth/authorization-allowance.ts"],"names":[],"mappings":";;;AAEA,MAAa,sBAAsB;IACjC,YACmB,OAAO,EACP,MAAM,EACN,QAAQ,EACR,MAAM;QAHN,YAAO,GAAP,OAAO,CAAA;QACP,WAAM,GAAN,MAAM,CAAA;QACN,aAAQ,GAAR,QAAQ,CAAA;QACR,WAAM,GAAN,MAAM,CAAA;IACtB,CAAC;IAEG,gBAAgB,CAAC,OAAsC;QAC5D,IACE,OAAO,CAAC,MAAM;YACd,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;YAC5B,IAAI,CAAC,MAAM;YACX,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EACzB;YAEA,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE;gBAC3D,OAAO,KAAK,CAAC;aACd;SACF;QAGD,IACE,OAAO,CAAC,QAAQ;YAChB,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE;YACzC,IAAI,CAAC,QAAQ;YACb,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EACtC;YACA,IACE,IAAI,CAAC,QAAQ,KAAK,KAAK;gBACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE;gBACxD,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAChC;gBACA,OAAO,KAAK,CAAC;aACd;SACF;QAED,IACE,OAAO,CAAC,MAAM;YACd,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;YAC5B,IAAI,CAAC,MAAM;YACX,IAAI,CAAC,MAAM,KAAK,EAAE,EAClB;YAEA,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE;gBAC3D,OAAO,KAAK,CAAC;aACd;SACF;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,iBAAiB,CAAC,OAAsC;QAC9D,OAAO,CACL,OAAO,CAAC,MAAM,KAAK,MAAM;YACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;YACvD,IAAI,CAAC,QAAQ,KAAK,MAAM,CACzB,CAAC;IACJ,CAAC;CACF;AA3DD,wDA2DC"}
+{"version":3,"file":"authorization-allowance.js","sourceRoot":"","sources":["../../../src/auth/authorization-allowance.ts"],"names":[],"mappings":";;;AAEA,MAAa,sBAAsB;IACjC,YACmB,OAAO,EACP,MAAM,EACN,QAAQ,EACR,MAAM;QAHN,YAAO,GAAP,OAAO,CAAA;QACP,WAAM,GAAN,MAAM,CAAA;QACN,aAAQ,GAAR,QAAQ,CAAA;QACR,WAAM,GAAN,MAAM,CAAA;IACtB,CAAC;IAEG,gBAAgB,CAAC,OAAsC;QAC5D,IACE,OAAO,CAAC,MAAM;YACd,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;YAC5B,IAAI,CAAC,MAAM;YACX,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EACzB;YAEA,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE;gBAC3D,OAAO,KAAK,CAAC;aACd;SACF;QAGD,IACE,OAAO,CAAC,QAAQ;YAChB,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE;YACzC,IAAI,CAAC,QAAQ;YACb,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EACtC;YACA,IACE,IAAI,CAAC,QAAQ,KAAK,KAAK;gBACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,EACxD;gBACA,OAAO,KAAK,CAAC;aACd;SACF;QAED,IACE,OAAO,CAAC,MAAM;YACd,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;YAC5B,IAAI,CAAC,MAAM;YACX,IAAI,CAAC,MAAM,KAAK,EAAE,EAClB;YAEA,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE;gBAC3D,OAAO,KAAK,CAAC;aACd;SACF;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAlDD,wDAkDC"}

package/lib/src/auth/http-authz.action-to-sub-objects.guard.util.d.ts

@@ -0,0 +1,11 @@
+import { ExecutionContext } from "@nestjs/common";
+export declare class HttpAuthzActionToSubObjectsGuardUtil {
+    private readonly context;
+    private readonly action;
+    private _authzGuard;
+    constructor(context: ExecutionContext, action: string);
+    isAuthorized(object: string, objectId: string, subObject: string, subObjectIds: string[], namespace?: string): boolean;
+    get params(): any;
+    get query(): any;
+    get body(): any;
+}

package/lib/src/auth/http-authz.action-to-sub-objects.guard.util.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpAuthzActionToSubObjectsGuardUtil = void 0;
+const http_authz_guard_util_1 = require("./http-authz.guard.util");
+class HttpAuthzActionToSubObjectsGuardUtil {
+    constructor(context, action) {
+        this.context = context;
+        this.action = action;
+        this._authzGuard = new http_authz_guard_util_1.HttpAuthzGuardUtil(context);
+    }
+    isAuthorized(object, objectId, subObject, subObjectIds, namespace) {
+        for (const id of subObjectIds) {
+            let requests = [];
+            if (namespace) {
+                requests = [
+                    {
+                        action: "",
+                        object: namespace,
+                        objectId: "",
+                    },
+                ];
+            }
+            requests = [
+                ...requests,
+                ...[
+                    {
+                        action: "",
+                        object,
+                        objectId,
+                    },
+                    {
+                        action: this.action,
+                        object: subObject,
+                        objectId: id,
+                    },
+                ],
+            ];
+            if (!this._authzGuard.isAuthorized(...requests)) {
+                return false;
+            }
+        }
+        return true;
+    }
+    get params() {
+        return this._authzGuard.params;
+    }
+    get query() {
+        return this._authzGuard.query;
+    }
+    get body() {
+        return this._authzGuard.body;
+    }
+}
+exports.HttpAuthzActionToSubObjectsGuardUtil = HttpAuthzActionToSubObjectsGuardUtil;
+//# sourceMappingURL=http-authz.action-to-sub-objects.guard.util.js.map

package/lib/src/auth/http-authz.action-to-sub-objects.guard.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-authz.action-to-sub-objects.guard.util.js","sourceRoot":"","sources":["../../../src/auth/http-authz.action-to-sub-objects.guard.util.ts"],"names":[],"mappings":";;;AACA,mEAA6D;AAK7D,MAAa,oCAAoC;IAG/C,YACmB,OAAyB,EACzB,MAAc;QADd,YAAO,GAAP,OAAO,CAAkB;QACzB,WAAM,GAAN,MAAM,CAAQ;QAE/B,IAAI,CAAC,WAAW,GAAG,IAAI,0CAAkB,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;IASM,YAAY,CACjB,MAAc,EACd,QAAgB,EAChB,SAAiB,EACjB,YAAsB,EACtB,SAAkB;QAElB,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE;YAC7B,IAAI,QAAQ,GAAG,EAAE,CAAC;YAElB,IAAI,SAAS,EAAE;gBACb,QAAQ,GAAG;oBACT;wBACE,MAAM,EAAE,EAAE;wBACV,MAAM,EAAE,SAAS;wBACjB,QAAQ,EAAE,EAAE;qBACb;iBACF,CAAC;aACH;YAED,QAAQ,GAAG;gBACT,GAAG,QAAQ;gBACX,GAAG;oBACD;wBACE,MAAM,EAAE,EAAE;wBACV,MAAM;wBACN,QAAQ;qBACT;oBACD;wBACE,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,MAAM,EAAE,SAAS;wBACjB,QAAQ,EAAE,EAAE;qBACb;iBACF;aACF,CAAC;YAEF,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,GAAG,QAAQ,CAAC,EAAE;gBAC/C,OAAO,KAAK,CAAC;aACd;SACF;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAW,MAAM;QACf,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;IACjC,CAAC;IAED,IAAW,KAAK;QACd,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;IAChC,CAAC;IAED,IAAW,IAAI;QACb,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IAC/B,CAAC;CACF;AAvED,oFAuEC"}

package/lib/src/auth/http-authz.attach-objects.guard.util.d.ts

@@ -0,0 +1,10 @@
+import { ExecutionContext } from "@nestjs/common";
+export declare class HttpAuthzAttachObjectsGuardUtil {
+    private readonly context;
+    private _util;
+    constructor(context: ExecutionContext);
+    isAuthorized(object: string, objectId: string, attachObject: string, attachObjectIds: string[], namespace?: string): boolean;
+    get params(): any;
+    get query(): any;
+    get body(): any;
+}

package/lib/src/auth/http-authz.attach-objects.guard.util.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpAuthzAttachObjectsGuardUtil = void 0;
+const http_authz_action_to_sub_objects_guard_util_1 = require("./http-authz.action-to-sub-objects.guard.util");
+class HttpAuthzAttachObjectsGuardUtil {
+    constructor(context) {
+        this.context = context;
+        this._util = new http_authz_action_to_sub_objects_guard_util_1.HttpAuthzActionToSubObjectsGuardUtil(context, "create");
+    }
+    isAuthorized(object, objectId, attachObject, attachObjectIds, namespace) {
+        return this._util.isAuthorized(object, objectId, attachObject, attachObjectIds, namespace);
+    }
+    get params() {
+        return this._util.params;
+    }
+    get query() {
+        return this._util.query;
+    }
+    get body() {
+        return this._util.body;
+    }
+}
+exports.HttpAuthzAttachObjectsGuardUtil = HttpAuthzAttachObjectsGuardUtil;
+//# sourceMappingURL=http-authz.attach-objects.guard.util.js.map

package/lib/src/auth/http-authz.attach-objects.guard.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-authz.attach-objects.guard.util.js","sourceRoot":"","sources":["../../../src/auth/http-authz.attach-objects.guard.util.ts"],"names":[],"mappings":";;;AACA,+GAAqG;AAKrG,MAAa,+BAA+B;IAG1C,YAA6B,OAAyB;QAAzB,YAAO,GAAP,OAAO,CAAkB;QACpD,IAAI,CAAC,KAAK,GAAG,IAAI,kFAAoC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3E,CAAC;IASM,YAAY,CACjB,MAAc,EACd,QAAgB,EAChB,YAAoB,EACpB,eAAyB,EACzB,SAAkB;QAElB,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAC5B,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,SAAS,CACV,CAAC;IACJ,CAAC;IAED,IAAW,MAAM;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3B,CAAC;IAED,IAAW,KAAK;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;IAC1B,CAAC;IAED,IAAW,IAAI;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;CACF;AAzCD,0EAyCC"}

package/lib/src/auth/http-authz.detach-objects.guard.util.d.ts

@@ -0,0 +1,10 @@
+import { ExecutionContext } from "@nestjs/common";
+export declare class HttpAuthzDetachObjectsGuardUtil {
+    private readonly context;
+    private _util;
+    constructor(context: ExecutionContext);
+    isAuthorized(object: string, objectId: string, detachObject: string, detachObjectIds: string[], namespace?: string): boolean;
+    get params(): any;
+    get query(): any;
+    get body(): any;
+}

package/lib/src/auth/http-authz.detach-objects.guard.util.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpAuthzDetachObjectsGuardUtil = void 0;
+const http_authz_action_to_sub_objects_guard_util_1 = require("./http-authz.action-to-sub-objects.guard.util");
+class HttpAuthzDetachObjectsGuardUtil {
+    constructor(context) {
+        this.context = context;
+        this._util = new http_authz_action_to_sub_objects_guard_util_1.HttpAuthzActionToSubObjectsGuardUtil(context, "delete");
+    }
+    isAuthorized(object, objectId, detachObject, detachObjectIds, namespace) {
+        return this._util.isAuthorized(object, objectId, detachObject, detachObjectIds, namespace);
+    }
+    get params() {
+        return this._util.params;
+    }
+    get query() {
+        return this._util.query;
+    }
+    get body() {
+        return this._util.body;
+    }
+}
+exports.HttpAuthzDetachObjectsGuardUtil = HttpAuthzDetachObjectsGuardUtil;
+//# sourceMappingURL=http-authz.detach-objects.guard.util.js.map

package/lib/src/auth/http-authz.detach-objects.guard.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-authz.detach-objects.guard.util.js","sourceRoot":"","sources":["../../../src/auth/http-authz.detach-objects.guard.util.ts"],"names":[],"mappings":";;;AACA,+GAAqG;AAKrG,MAAa,+BAA+B;IAG1C,YAA6B,OAAyB;QAAzB,YAAO,GAAP,OAAO,CAAkB;QACpD,IAAI,CAAC,KAAK,GAAG,IAAI,kFAAoC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3E,CAAC;IASM,YAAY,CACjB,MAAc,EACd,QAAgB,EAChB,YAAoB,EACpB,eAAyB,EACzB,SAAkB;QAElB,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAC5B,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,SAAS,CACV,CAAC;IACJ,CAAC;IAED,IAAW,MAAM;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3B,CAAC;IAED,IAAW,KAAK;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;IAC1B,CAAC;IAED,IAAW,IAAI;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;CACF;AAzCD,0EAyCC"}

package/lib/src/auth/{http-authz-guard.util.d.ts → http-authz.guard.util.d.ts}

@@ -5,6 +5,7 @@ export declare class HttpAuthzGuardUtil {
     private _token;
     readonly params: any;
     readonly query: any;
+    readonly body: any;
     constructor(context: ExecutionContext);
     isAuthorized(...authzRequests: AuthorizationRequestInterface[]): boolean;
     private _doesScopeAuthorizeRequest;

package/lib/src/auth/{http-authz-guard.util.js → http-authz.guard.util.js}

@@ -24,6 +24,7 @@ class HttpAuthzGuardUtil {
         this._token = decodedToken;
         this.params = request.params;
         this.query = request.query;
+        this.body = request.body;
     }
     isAuthorized(...authzRequests) {
         const scopes = this._token.scopes;
@@ -54,4 +55,4 @@ class HttpAuthzGuardUtil {
     }
 }
 exports.HttpAuthzGuardUtil = HttpAuthzGuardUtil;
-//# sourceMappingURL=http-authz-guard.util.js.map
+//# sourceMappingURL=http-authz.guard.util.js.map

package/lib/src/auth/http-authz.guard.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-authz.guard.util.js","sourceRoot":"","sources":["../../../src/auth/http-authz.guard.util.ts"],"names":[],"mappings":";;;AAAA,2CAA6E;AAC7E,oCAAoC;AAEpC,uEAAmE;AAEnE,MAAa,kBAAkB;IAM7B,YAA6B,OAAyB;QAAzB,YAAO,GAAP,OAAO,CAAkB;QACpD,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC1D,IAAI,CAAC,mBAAmB,EAAE;YACxB,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;SAClE;QACD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE;YACjC,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;SAClE;QAED,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAmB,CAAC;QAC/D,IAAI,CAAC,YAAY,EAAE;YACjB,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;SAClE;QAED,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAEM,YAAY,CAAC,GAAG,aAA8C;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAElC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE;YAC1B,IAAI,IAAI,CAAC,0BAA0B,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE;gBACzD,OAAO,IAAI,CAAC;aACb;SACF;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,0BAA0B,CAChC,KAAa,EACb,aAA8C;QAE9C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE/B,MAAM,uBAAuB,GAAG,EAAE,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE;YACxC,uBAAuB,CAAC,IAAI,CAC1B,IAAI,gDAAsB,CACxB,IAAI,CAAC,MAAM,CAAC,GAAG,EACf,KAAK,CAAC,CAAC,CAAC,EACR,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EACZ,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CACb,CACF,CAAC;SACH;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE;gBAC/B,OAAO,KAAK,CAAC;aACd;YACD,MAAM,SAAS,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE;gBACxC,OAAO,KAAK,CAAC;aACd;SACF;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAxED,gDAwEC"}

package/lib/src/auth/index.d.ts

@@ -1,4 +1,7 @@
 export * from "./authenticator.interface";
 export * from "./topic-authorizor.interface";
 export * from "./fake-authenticator";
-export * from "./http-authz-guard.util";
+export * from "./http-authz.guard.util";
+export * from "./http-authz.attach-objects.guard.util";
+export * from "./http-authz.detach-objects.guard.util";
+export * from "./http-authz.action-to-sub-objects.guard.util";

package/lib/src/auth/index.js

@@ -13,5 +13,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./authenticator.interface"), exports);
 __exportStar(require("./topic-authorizor.interface"), exports);
 __exportStar(require("./fake-authenticator"), exports);
-__exportStar(require("./http-authz-guard.util"), exports);
+__exportStar(require("./http-authz.guard.util"), exports);
+__exportStar(require("./http-authz.attach-objects.guard.util"), exports);
+__exportStar(require("./http-authz.detach-objects.guard.util"), exports);
+__exportStar(require("./http-authz.action-to-sub-objects.guard.util"), exports);
 //# sourceMappingURL=index.js.map

package/lib/src/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/index.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,4DAA0C;AAC1C,+DAA6C;AAC7C,uDAAqC;AACrC,0DAAwC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/index.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,4DAA0C;AAC1C,+DAA6C;AAC7C,uDAAqC;AACrC,0DAAwC;AACxC,yEAAuD;AACvD,yEAAuD;AACvD,gFAA8D"}

package/lib/src/config/default-config.js

@@ -114,7 +114,7 @@ let DefaultConfig = class DefaultConfig {
         return (process.env.LOG_LEVELS || "debug,info,error").trim().split(",");
     }
     get httpPort() {
-        return parseInt(process.env.HTTP_PORT, 10);
+        return parseInt(process.env.HTTP_PORT || "3000", 10);
     }
     get metrics() {
         return new metrics_host_config_1.MetricsHostConfig(process.env.GRAPHITE_HOST, process.env.GRAPHITE_PORT, process.env.METRICS_ENABLED);

package/lib/src/config/default-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"default-config.js","sourceRoot":"","sources":["../../../src/config/default-config.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+DAA0D;AAG1D,yBAAyB;AACzB,mCAAuC;AACvC,iDAA6C;AAE7C,6CAAyC;AAEzC,2CAA4C;AAE5C,iEAA6D;AAE7D,6DAAwD;AAIxD,IAAa,aAAa,GAA1B,MAAa,aAAa;IAKxB,YACE,QAAgB,EAChB,OAAe,EACE,SAAiB,EAClC,mBAA4B;QADX,cAAS,GAAT,SAAS,CAAQ;QAGlC,IAAI,CAAC,KAAK,CACR,QAAQ,EACR,OAAO,EACP,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,mBAAmB,IAAI,EAAE,CAClD,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IAC1B,CAAC;IAEM,MAAM;QACX,OAAO;YACL,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC;IACJ,CAAC;IAES,KAAK,CAAC,QAAgB,EAAE,OAAe,EAAE,WAAmB;QACpE,MAAM,WAAW,GAAG,GAAG,QAAQ,MAAM,CAAC;QACtC,MAAM,UAAU,GAAG,GAAG,WAAW,IAAI,WAAW,MAAM,CAAC;QACvD,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;YAC7B,eAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;SAC9B;QAED,MAAM,WAAW,GAAG,GAAG,WAAW,IAAI,WAAW,GAC/C,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EACtB,aAAa,CAAC;QACd,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE;YAC9B,MAAM,SAAS,GAAG,cAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;YAEtD,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE;gBACzB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;aAC/B;SACF;QAED,MAAM,kBAAkB,GAAG,GAAG,WAAW,IAAI,WAAW,eAAe,CAAC;QACxE,IAAI,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE;YACrC,MAAM,SAAS,GAAG,cAAK,CAAC,EAAE,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC;YAE7D,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE;gBACzB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;aAC/B;SACF;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,OAAO,eAAe,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC;QACjC,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,OAAO,CAAC;IAC7C,CAAC;IAED,IAAW,gBAAgB;QACzB,OAAO,OAAO,CAAC,GAAG,CAAC,wBAAwC,CAAC;IAC9D,CAAC;IAED,IAAW,eAAe;QACxB,OAAO,OAAO,CAAC,GAAG,CAAC,uBAAsC,CAAC;IAC5D,CAAC;IAED,IAAW,UAAU;QACnB,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,eAAe,CAAC;IACzD,CAAC;IAED,IAAW,OAAO;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,IAAW,QAAQ;QACjB,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,IAAW,UAAU;QACnB,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC;IACzC,CAAC;IAED,IAAW,SAAS;QAClB,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,KAAK,CAAC;IACzC,CAAC;IAED,IAAW,UAAU;QACnB,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,MAAM,CAAC;IAC3C,CAAC;IAED,IAAW,WAAW;QACpB,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,MAAM,CAAC;IAC7C,CAAC;IAED,IAAW,QAAQ;QACjB,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;IACrC,CAAC;IAED,IAAW,KAAK;QACd,OAAO,IAAI,0BAAW,CACpB,OAAO,CAAC,GAAG,CAAC,aAAa,EACzB,OAAO,CAAC,GAAG,CAAC,UAAU,EACtB,OAAO,CAAC,GAAG,CAAC,UAAU,EACtB,OAAO,CAAC,GAAG,CAAC,cAAc,EAC1B,OAAO,CAAC,GAAG,CAAC,cAAc,EAC1B,OAAO,CAAC,GAAG,CAAC,cAAc,EAC1B,OAAO,CAAC,GAAG,CAAC,wBAAwB;YAClC,GAAG,IAAI,CAAC,QAAQ,qBAAqB,EACvC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CACpE,CAAC;IACJ,CAAC;IAED,IAAW,eAAe;QACxB,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC9B,CAAC;IAED,IAAW,SAAS;QAClB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1E,CAAC;IAED,IAAW,QAAQ;QACjB,OAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,IAAW,OAAO;QAChB,OAAO,IAAI,uCAAiB,CAC1B,OAAO,CAAC,GAAG,CAAC,aAAa,EACzB,OAAO,CAAC,GAAG,CAAC,aAAa,EACzB,OAAO,CAAC,GAAG,CAAC,eAAe,CAC5B,CAAC;IACJ,CAAC;IAED,IAAW,GAAG;QACZ,OAAO,IAAI,sBAAS,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC;IAED,IAAW,eAAe;QACxB,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,cAAc,CAAC;IACzD,CAAC;IAED,IAAW,aAAa;QACtB,OAAO,IAAI,0CAAmB,CAC5B,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,2BAA2B,EAC5D,OAAO,CAAC,GAAG,CAAC,mCAAmC,IAAI,IAAI,CACxD,CAAC;IACJ,CAAC;IAED,IAAW,YAAY;QACrB,OAAO,CACJ,OAAO,CAAC,GAAG,CAAC,aAAkC;YAC/C,qCAAgB,CAAC,OAAO,CACzB,CAAC;IACJ,CAAC;IAED,IAAW,UAAU;QACnB,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM,CAAC;IAC5C,CAAC;IAED,IAAW,aAAa;QACtB,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC;IAC/C,CAAC;CACF,CAAA;AApLY,aAAa;IADzB,mBAAU,EAAE;;GACA,aAAa,CAoLzB;AApLY,sCAAa"}
+{"version":3,"file":"default-config.js","sourceRoot":"","sources":["../../../src/config/default-config.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+DAA0D;AAG1D,yBAAyB;AACzB,mCAAuC;AACvC,iDAA6C;AAE7C,6CAAyC;AAEzC,2CAA4C;AAE5C,iEAA6D;AAE7D,6DAAwD;AAIxD,IAAa,aAAa,GAA1B,MAAa,aAAa;IAKxB,YACE,QAAgB,EAChB,OAAe,EACE,SAAiB,EAClC,mBAA4B;QADX,cAAS,GAAT,SAAS,CAAQ;QAGlC,IAAI,CAAC,KAAK,CACR,QAAQ,EACR,OAAO,EACP,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,mBAAmB,IAAI,EAAE,CAClD,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IAC1B,CAAC;IAEM,MAAM;QACX,OAAO;YACL,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC;IACJ,CAAC;IAES,KAAK,CAAC,QAAgB,EAAE,OAAe,EAAE,WAAmB;QACpE,MAAM,WAAW,GAAG,GAAG,QAAQ,MAAM,CAAC;QACtC,MAAM,UAAU,GAAG,GAAG,WAAW,IAAI,WAAW,MAAM,CAAC;QACvD,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;YAC7B,eAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;SAC9B;QAED,MAAM,WAAW,GAAG,GAAG,WAAW,IAAI,WAAW,GAC/C,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EACtB,aAAa,CAAC;QACd,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE;YAC9B,MAAM,SAAS,GAAG,cAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;YAEtD,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE;gBACzB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;aAC/B;SACF;QAED,MAAM,kBAAkB,GAAG,GAAG,WAAW,IAAI,WAAW,eAAe,CAAC;QACxE,IAAI,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE;YACrC,MAAM,SAAS,GAAG,cAAK,CAAC,EAAE,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC;YAE7D,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE;gBACzB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;aAC/B;SACF;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,OAAO,eAAe,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC;QACjC,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,OAAO,CAAC;IAC7C,CAAC;IAED,IAAW,gBAAgB;QACzB,OAAO,OAAO,CAAC,GAAG,CAAC,wBAAwC,CAAC;IAC9D,CAAC;IAED,IAAW,eAAe;QACxB,OAAO,OAAO,CAAC,GAAG,CAAC,uBAAsC,CAAC;IAC5D,CAAC;IAED,IAAW,UAAU;QACnB,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,eAAe,CAAC;IACzD,CAAC;IAED,IAAW,OAAO;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,IAAW,QAAQ;QACjB,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,IAAW,UAAU;QACnB,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC;IACzC,CAAC;IAED,IAAW,SAAS;QAClB,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,KAAK,CAAC;IACzC,CAAC;IAED,IAAW,UAAU;QACnB,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,MAAM,CAAC;IAC3C,CAAC;IAED,IAAW,WAAW;QACpB,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,MAAM,CAAC;IAC7C,CAAC;IAED,IAAW,QAAQ;QACjB,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;IACrC,CAAC;IAED,IAAW,KAAK;QACd,OAAO,IAAI,0BAAW,CACpB,OAAO,CAAC,GAAG,CAAC,aAAa,EACzB,OAAO,CAAC,GAAG,CAAC,UAAU,EACtB,OAAO,CAAC,GAAG,CAAC,UAAU,EACtB,OAAO,CAAC,GAAG,CAAC,cAAc,EAC1B,OAAO,CAAC,GAAG,CAAC,cAAc,EAC1B,OAAO,CAAC,GAAG,CAAC,cAAc,EAC1B,OAAO,CAAC,GAAG,CAAC,wBAAwB;YAClC,GAAG,IAAI,CAAC,QAAQ,qBAAqB,EACvC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CACpE,CAAC;IACJ,CAAC;IAED,IAAW,eAAe;QACxB,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC9B,CAAC;IAED,IAAW,SAAS;QAClB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1E,CAAC;IAED,IAAW,QAAQ;QACjB,OAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,IAAW,OAAO;QAChB,OAAO,IAAI,uCAAiB,CAC1B,OAAO,CAAC,GAAG,CAAC,aAAa,EACzB,OAAO,CAAC,GAAG,CAAC,aAAa,EACzB,OAAO,CAAC,GAAG,CAAC,eAAe,CAC5B,CAAC;IACJ,CAAC;IAED,IAAW,GAAG;QACZ,OAAO,IAAI,sBAAS,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC;IAED,IAAW,eAAe;QACxB,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,cAAc,CAAC;IACzD,CAAC;IAED,IAAW,aAAa;QACtB,OAAO,IAAI,0CAAmB,CAC5B,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,2BAA2B,EAC5D,OAAO,CAAC,GAAG,CAAC,mCAAmC,IAAI,IAAI,CACxD,CAAC;IACJ,CAAC;IAED,IAAW,YAAY;QACrB,OAAO,CACJ,OAAO,CAAC,GAAG,CAAC,aAAkC;YAC/C,qCAAgB,CAAC,OAAO,CACzB,CAAC;IACJ,CAAC;IAED,IAAW,UAAU;QACnB,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM,CAAC;IAC5C,CAAC;IAED,IAAW,aAAa;QACtB,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC;IAC/C,CAAC;CACF,CAAA;AApLY,aAAa;IADzB,mBAAU,EAAE;;GACA,aAAa,CAoLzB;AApLY,sCAAa"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cryptexlabs/codex-nodejs-common",
-  "version": "0.1.16",
+  "version": "0.1.20",
   "description": "Common code for Assistant applications",
   "main": "lib/src/index.js",
   "repository": "git@gitlab.com:cryptexlabs/public/codex-nodejs-common.git",

package/src/auth/authorization-allowance.ts

@@ -30,8 +30,7 @@ export class AuthorizationAllowance {
     ) {
       if (
         this.objectId !== "any" &&
-        request.objectId.toString() !== this.objectId.toString() &&
-        !this._isRequestingSelf(request)
+        request.objectId.toString() !== this.objectId.toString()
       ) {
         return false;
       }
@@ -51,12 +50,4 @@ export class AuthorizationAllowance {
 
     return true;
   }
-
-  private _isRequestingSelf(request: AuthorizationRequestInterface) {
-    return (
-      request.object === "user" &&
-      request.objectId.toString() === this.subject.toString() &&
-      this.objectId === "self"
-    );
-  }
 }

package/src/auth/http-authz.action-to-sub-objects.guard.util.ts

@@ -0,0 +1,78 @@
+import { ExecutionContext } from "@nestjs/common";
+import { HttpAuthzGuardUtil } from "./http-authz.guard.util";
+
+/**
+ * Authorizes attachments of objects to another object by object id
+ */
+export class HttpAuthzActionToSubObjectsGuardUtil {
+  private _authzGuard: HttpAuthzGuardUtil;
+
+  constructor(
+    private readonly context: ExecutionContext,
+    private readonly action: string
+  ) {
+    this._authzGuard = new HttpAuthzGuardUtil(context);
+  }
+
+  /**
+   * @param {string} object The object name of object A
+   * @param {string} objectId The object ID of object A
+   * @param {string} subObject The object name of objects B
+   * @param {string[]} subObjectIds The object IDs of Objects B to attach to object A
+   * @param {string?} namespace (Optional) The namespace of objects A and B
+   */
+  public isAuthorized(
+    object: string,
+    objectId: string,
+    subObject: string,
+    subObjectIds: string[],
+    namespace?: string
+  ) {
+    for (const id of subObjectIds) {
+      let requests = [];
+
+      if (namespace) {
+        requests = [
+          {
+            action: "",
+            object: namespace,
+            objectId: "",
+          },
+        ];
+      }
+
+      requests = [
+        ...requests,
+        ...[
+          {
+            action: "",
+            object,
+            objectId,
+          },
+          {
+            action: this.action,
+            object: subObject,
+            objectId: id,
+          },
+        ],
+      ];
+
+      if (!this._authzGuard.isAuthorized(...requests)) {
+        return false;
+      }
+    }
+    return true;
+  }
+
+  public get params() {
+    return this._authzGuard.params;
+  }
+
+  public get query() {
+    return this._authzGuard.query;
+  }
+
+  public get body() {
+    return this._authzGuard.body;
+  }
+}

package/src/auth/http-authz.attach-objects.guard.util.spec.ts

@@ -0,0 +1,369 @@
+import { ExecutionContext } from "@nestjs/common";
+import * as jwt from "jsonwebtoken";
+import { HttpAuthzAttachObjectsGuardUtil } from "./http-authz.attach-objects.guard.util";
+
+describe(HttpAuthzAttachObjectsGuardUtil.name, () => {
+  it("Should allow super admin to attach a group to a user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [`cool-app:::any:any:any:any:any:any`],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+          params: {
+            userId: "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+          },
+          body: ["680dddec-f0b9-4a01-b8b5-be725f946935"],
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzAttachObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        ["5d549988-a3bf-49d7-91ae-aeef65a073cc"],
+        "cool-app"
+      )
+    ).toBe(true);
+  });
+
+  it("Should allow someone with permission to attach any group to a user to attach a group to the user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [
+          `cool-app:::user:4d2114ca-24e2-43e5-bddb-d9a6688b8340::group:any:create`,
+        ],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzAttachObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        ["5d549988-a3bf-49d7-91ae-aeef65a073cc"],
+        "cool-app"
+      )
+    ).toBe(true);
+  });
+
+  it("Should allow someone with permission to do anything to any group on a user to attach a group to the user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [
+          `cool-app:::user:4d2114ca-24e2-43e5-bddb-d9a6688b8340::group:any:any`,
+        ],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+          params: {
+            userId: "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+          },
+          body: ["680dddec-f0b9-4a01-b8b5-be725f946935"],
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzAttachObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        ["5d549988-a3bf-49d7-91ae-aeef65a073cc"],
+        "cool-app"
+      )
+    ).toBe(true);
+  });
+
+  it("Should allow someone with permission to do anything to any sub object for a user to attach a group to the user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [
+          `cool-app:::user:4d2114ca-24e2-43e5-bddb-d9a6688b8340::any:any:any`,
+        ],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+          params: {
+            userId: "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+          },
+          body: ["680dddec-f0b9-4a01-b8b5-be725f946935"],
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzAttachObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        ["5d549988-a3bf-49d7-91ae-aeef65a073cc"],
+        "cool-app"
+      )
+    ).toBe(true);
+  });
+
+  it("Should allow someone with permission to attach a specific group to a user to attach the group to the user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [
+          `cool-app:::user:4d2114ca-24e2-43e5-bddb-d9a6688b8340::group:680dddec-f0b9-4a01-b8b5-be725f946935:create`,
+        ],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+          params: {
+            userId: "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+          },
+          body: ["680dddec-f0b9-4a01-b8b5-be725f946935"],
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzAttachObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        ["680dddec-f0b9-4a01-b8b5-be725f946935"],
+        "cool-app"
+      )
+    ).toBe(true);
+  });
+
+  it("Should not allow someone with permission to attach any group to a different user to attach a group to the user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [
+          `cool-app:::user:55854a66-5a73-4416-b03a-eba4417b691c::group:any:create`,
+        ],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+          params: {
+            userId: "001d4f53-798b-4a0b-8ef7-330a7bf72147",
+          },
+          body: ["680dddec-f0b9-4a01-b8b5-be725f946935"],
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzAttachObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        ["5d549988-a3bf-49d7-91ae-aeef65a073cc"],
+        "cool-app"
+      )
+    ).toBe(false);
+  });
+
+  it("Should not allow someone with permission to do anything to a different user to attach a group to the user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [
+          `cool-app:::user:55854a66-5a73-4416-b03a-eba4417b691c::group:any:any`,
+        ],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+          params: {
+            userId: "001d4f53-798b-4a0b-8ef7-330a7bf72147",
+          },
+          body: ["680dddec-f0b9-4a01-b8b5-be725f946935"],
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzAttachObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        ["5d549988-a3bf-49d7-91ae-aeef65a073cc"],
+        "cool-app"
+      )
+    ).toBe(false);
+  });
+
+  it("Should not allow someone with permission to do anything to any sub object for a different user to attach a group to the user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [
+          `cool-app:::user:55854a66-5a73-4416-b03a-eba4417b691c::any:any:any`,
+        ],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+          params: {
+            userId: "001d4f53-798b-4a0b-8ef7-330a7bf72147",
+          },
+          body: ["680dddec-f0b9-4a01-b8b5-be725f946935"],
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzAttachObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        ["5d549988-a3bf-49d7-91ae-aeef65a073cc"],
+        "cool-app"
+      )
+    ).toBe(false);
+  });
+
+  it("Should not allow someone with permission to attach a specific group to a different user to attach the group to the user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [
+          `cool-app:::user:4d2114ca-24e2-43e5-bddb-d9a6688b8340::group:680dddec-f0b9-4a01-b8b5-be725f946935:create`,
+        ],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+          params: {
+            userId: "001d4f53-798b-4a0b-8ef7-330a7bf72147",
+          },
+          body: ["680dddec-f0b9-4a01-b8b5-be725f946935"],
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzAttachObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        ["5d549988-a3bf-49d7-91ae-aeef65a073cc"],
+        "cool-app"
+      )
+    ).toBe(false);
+  });
+
+  it("Should not allow someone with permission to attach a different specific permission to a user to attach the group to the user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [
+          `cool-app:::user:4d2114ca-24e2-43e5-bddb-d9a6688b8340::group:680dddec-f0b9-4a01-b8b5-be725f946935:create`,
+        ],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+          params: {
+            userId: "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+          },
+          body: ["5be3176f-c066-4418-b682-18e16fd07b84"],
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzAttachObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        ["5d549988-a3bf-49d7-91ae-aeef65a073cc"],
+        "cool-app"
+      )
+    ).toBe(false);
+  });
+});

package/src/auth/http-authz.attach-objects.guard.util.ts

@@ -0,0 +1,48 @@
+import { ExecutionContext } from "@nestjs/common";
+import { HttpAuthzActionToSubObjectsGuardUtil } from "./http-authz.action-to-sub-objects.guard.util";
+
+/**
+ * Authorizes attachments of objects to another object by object id
+ */
+export class HttpAuthzAttachObjectsGuardUtil {
+  private _util: HttpAuthzActionToSubObjectsGuardUtil;
+
+  constructor(private readonly context: ExecutionContext) {
+    this._util = new HttpAuthzActionToSubObjectsGuardUtil(context, "create");
+  }
+
+  /**
+   * @param {string} object The object name of object A
+   * @param {string} objectId The object ID of object A
+   * @param {string} attachObject The object name of objects B
+   * @param {string[]} attachObjectIds The object IDs of Objects B to attach to object A
+   * @param {string?} namespace (Optional) The namespace of objects A and B
+   */
+  public isAuthorized(
+    object: string,
+    objectId: string,
+    attachObject: string,
+    attachObjectIds: string[],
+    namespace?: string
+  ) {
+    return this._util.isAuthorized(
+      object,
+      objectId,
+      attachObject,
+      attachObjectIds,
+      namespace
+    );
+  }
+
+  public get params() {
+    return this._util.params;
+  }
+
+  public get query() {
+    return this._util.query;
+  }
+
+  public get body() {
+    return this._util.body;
+  }
+}

package/src/auth/http-authz.detach-objects.guard.util.spec.ts

@@ -0,0 +1,369 @@
+import { ExecutionContext } from "@nestjs/common";
+import * as jwt from "jsonwebtoken";
+import { HttpAuthzDetachObjectsGuardUtil } from "./http-authz.detach-objects.guard.util";
+
+describe(HttpAuthzDetachObjectsGuardUtil.name, () => {
+  it("Should allow super admin to detach a group to a user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [`cool-app:::any:any:any:any:any:any`],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+          params: {
+            userId: "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+          },
+          body: ["680dddec-f0b9-4a01-b8b5-be725f946935"],
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzDetachObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        ["5d549988-a3bf-49d7-91ae-aeef65a073cc"],
+        "cool-app"
+      )
+    ).toBe(true);
+  });
+
+  it("Should allow someone with permission to detach any group to a user to detach a group from the user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [
+          `cool-app:::user:4d2114ca-24e2-43e5-bddb-d9a6688b8340::group:any:delete`,
+        ],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzDetachObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        ["5d549988-a3bf-49d7-91ae-aeef65a073cc"],
+        "cool-app"
+      )
+    ).toBe(true);
+  });
+
+  it("Should allow someone with permission to do anything to any group on a user to detach a group from the user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [
+          `cool-app:::user:4d2114ca-24e2-43e5-bddb-d9a6688b8340::group:any:any`,
+        ],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+          params: {
+            userId: "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+          },
+          body: ["680dddec-f0b9-4a01-b8b5-be725f946935"],
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzDetachObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        ["5d549988-a3bf-49d7-91ae-aeef65a073cc"],
+        "cool-app"
+      )
+    ).toBe(true);
+  });
+
+  it("Should allow someone with permission to do anything to any sub object for a user to detach a group from the user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [
+          `cool-app:::user:4d2114ca-24e2-43e5-bddb-d9a6688b8340::any:any:any`,
+        ],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+          params: {
+            userId: "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+          },
+          body: ["680dddec-f0b9-4a01-b8b5-be725f946935"],
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzDetachObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        ["5d549988-a3bf-49d7-91ae-aeef65a073cc"],
+        "cool-app"
+      )
+    ).toBe(true);
+  });
+
+  it("Should allow someone with permission to detach a specific group to a user to detach the group to the user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [
+          `cool-app:::user:4d2114ca-24e2-43e5-bddb-d9a6688b8340::group:680dddec-f0b9-4a01-b8b5-be725f946935:delete`,
+        ],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+          params: {
+            userId: "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+          },
+          body: ["680dddec-f0b9-4a01-b8b5-be725f946935"],
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzDetachObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        ["680dddec-f0b9-4a01-b8b5-be725f946935"],
+        "cool-app"
+      )
+    ).toBe(true);
+  });
+
+  it("Should not allow someone with permission to detach any group to a different user to detach a group from the user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [
+          `cool-app:::user:55854a66-5a73-4416-b03a-eba4417b691c::group:any:create`,
+        ],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+          params: {
+            userId: "001d4f53-798b-4a0b-8ef7-330a7bf72147",
+          },
+          body: ["680dddec-f0b9-4a01-b8b5-be725f946935"],
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzDetachObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        ["5d549988-a3bf-49d7-91ae-aeef65a073cc"],
+        "cool-app"
+      )
+    ).toBe(false);
+  });
+
+  it("Should not allow someone with permission to do anything to a different user to detach a group from the user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [
+          `cool-app:::user:55854a66-5a73-4416-b03a-eba4417b691c::group:any:any`,
+        ],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+          params: {
+            userId: "001d4f53-798b-4a0b-8ef7-330a7bf72147",
+          },
+          body: ["680dddec-f0b9-4a01-b8b5-be725f946935"],
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzDetachObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        ["5d549988-a3bf-49d7-91ae-aeef65a073cc"],
+        "cool-app"
+      )
+    ).toBe(false);
+  });
+
+  it("Should not allow someone with permission to do anything to any sub object for a different user to detach a group from the user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [
+          `cool-app:::user:55854a66-5a73-4416-b03a-eba4417b691c::any:any:any`,
+        ],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+          params: {
+            userId: "001d4f53-798b-4a0b-8ef7-330a7bf72147",
+          },
+          body: ["680dddec-f0b9-4a01-b8b5-be725f946935"],
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzDetachObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        ["5d549988-a3bf-49d7-91ae-aeef65a073cc"],
+        "cool-app"
+      )
+    ).toBe(false);
+  });
+
+  it("Should not allow someone with permission to detach a specific group to a different user to detach the group to the user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [
+          `cool-app:::user:4d2114ca-24e2-43e5-bddb-d9a6688b8340::group:680dddec-f0b9-4a01-b8b5-be725f946935:create`,
+        ],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+          params: {
+            userId: "001d4f53-798b-4a0b-8ef7-330a7bf72147",
+          },
+          body: ["680dddec-f0b9-4a01-b8b5-be725f946935"],
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzDetachObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        ["5d549988-a3bf-49d7-91ae-aeef65a073cc"],
+        "cool-app"
+      )
+    ).toBe(false);
+  });
+
+  it("Should not allow someone with permission to detach a different specific permission to a user to detach the group to the user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [
+          `cool-app:::user:4d2114ca-24e2-43e5-bddb-d9a6688b8340::group:680dddec-f0b9-4a01-b8b5-be725f946935:create`,
+        ],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+          params: {
+            userId: "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+          },
+          body: ["5be3176f-c066-4418-b682-18e16fd07b84"],
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzDetachObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        ["5d549988-a3bf-49d7-91ae-aeef65a073cc"],
+        "cool-app"
+      )
+    ).toBe(false);
+  });
+});

package/src/auth/http-authz.detach-objects.guard.util.ts

@@ -0,0 +1,48 @@
+import { ExecutionContext } from "@nestjs/common";
+import { HttpAuthzActionToSubObjectsGuardUtil } from "./http-authz.action-to-sub-objects.guard.util";
+
+/**
+ * Authorizes detachment of objects to another object by object id
+ */
+export class HttpAuthzDetachObjectsGuardUtil {
+  private _util: HttpAuthzActionToSubObjectsGuardUtil;
+
+  constructor(private readonly context: ExecutionContext) {
+    this._util = new HttpAuthzActionToSubObjectsGuardUtil(context, "delete");
+  }
+
+  /**
+   * @param {string} object The object name of object A
+   * @param {string} objectId The object ID of object A
+   * @param {string} detachObject The object name of objects B
+   * @param {string[]} detachObjectIds The object IDs of Objects B to attach to object A
+   * @param {string?} namespace (Optional) The namespace of objects A and B
+   */
+  public isAuthorized(
+    object: string,
+    objectId: string,
+    detachObject: string,
+    detachObjectIds: string[],
+    namespace?: string
+  ) {
+    return this._util.isAuthorized(
+      object,
+      objectId,
+      detachObject,
+      detachObjectIds,
+      namespace
+    );
+  }
+
+  public get params() {
+    return this._util.params;
+  }
+
+  public get query() {
+    return this._util.query;
+  }
+
+  public get body() {
+    return this._util.body;
+  }
+}

package/src/auth/{http-authz-guard.util.spec.ts → http-authz.guard.util.spec.ts}

@@ -2,7 +2,7 @@ import { ExecutionContext } from "@nestjs/common";
 import { instance, mock, when } from "ts-mockito";
 import { HttpArgumentsHost } from "@nestjs/common/interfaces/features/arguments-host.interface";
 import * as jwt from "jsonwebtoken";
-import { HttpAuthzGuardUtil } from "./http-authz-guard.util";
+import { HttpAuthzGuardUtil } from "./http-authz.guard.util";
 
 describe("HttpAuthzGuardUtil", () => {
   let mockedExecutionContext: ExecutionContext;
@@ -80,7 +80,7 @@ describe("HttpAuthzGuardUtil", () => {
     ).toBe(true);
   });
 
-  it("Should authorize a scope with 'self' for object id", () => {
+  it("Should not authorize a scope with 'self' for object id", () => {
     const request = getRequestWithAuthorizationBearerScopes("johndoe", [
       "user:self:update",
     ]) as any;
@@ -94,7 +94,7 @@ describe("HttpAuthzGuardUtil", () => {
         object: "user",
         objectId: "johndoe",
       })
-    ).toBe(true);
+    ).toBe(false);
   });
 
   it("Should authorize a multi level scope definition", () => {

package/src/auth/{http-authz-guard.util.ts → http-authz.guard.util.ts}

@@ -7,6 +7,7 @@ export class HttpAuthzGuardUtil {
   private _token: any;
   public readonly params: any;
   public readonly query: any;
+  public readonly body: any;
 
   constructor(private readonly context: ExecutionContext) {
     const request = context.switchToHttp().getRequest();
@@ -28,6 +29,7 @@ export class HttpAuthzGuardUtil {
     this._token = decodedToken;
     this.params = request.params;
     this.query = request.query;
+    this.body = request.body;
   }
 
   public isAuthorized(...authzRequests: AuthorizationRequestInterface[]) {

package/src/auth/index.ts

@@ -1,4 +1,7 @@
 export * from "./authenticator.interface";
 export * from "./topic-authorizor.interface";
 export * from "./fake-authenticator";
-export * from "./http-authz-guard.util";
+export * from "./http-authz.guard.util";
+export * from "./http-authz.attach-objects.guard.util";
+export * from "./http-authz.detach-objects.guard.util";
+export * from "./http-authz.action-to-sub-objects.guard.util";

package/src/config/default-config.ts

@@ -156,7 +156,7 @@ export class DefaultConfig implements JsonSerializableInterface<any> {
   }
 
   public get httpPort(): number {
-    return parseInt(process.env.HTTP_PORT, 10);
+    return parseInt(process.env.HTTP_PORT || "3000", 10);
   }
 
   public get metrics(): SwitchConfigInterface & HostConfigInterface {

package/lib/src/auth/http-authz-guard.util.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"http-authz-guard.util.js","sourceRoot":"","sources":["../../../src/auth/http-authz-guard.util.ts"],"names":[],"mappings":";;;AAAA,2CAA6E;AAC7E,oCAAoC;AAEpC,uEAAmE;AAEnE,MAAa,kBAAkB;IAK7B,YAA6B,OAAyB;QAAzB,YAAO,GAAP,OAAO,CAAkB;QACpD,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC1D,IAAI,CAAC,mBAAmB,EAAE;YACxB,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;SAClE;QACD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE;YACjC,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;SAClE;QAED,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAmB,CAAC;QAC/D,IAAI,CAAC,YAAY,EAAE;YACjB,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;SAClE;QAED,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC7B,CAAC;IAEM,YAAY,CAAC,GAAG,aAA8C;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAElC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE;YAC1B,IAAI,IAAI,CAAC,0BAA0B,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE;gBACzD,OAAO,IAAI,CAAC;aACb;SACF;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,0BAA0B,CAChC,KAAa,EACb,aAA8C;QAE9C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE/B,MAAM,uBAAuB,GAAG,EAAE,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE;YACxC,uBAAuB,CAAC,IAAI,CAC1B,IAAI,gDAAsB,CACxB,IAAI,CAAC,MAAM,CAAC,GAAG,EACf,KAAK,CAAC,CAAC,CAAC,EACR,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EACZ,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CACb,CACF,CAAC;SACH;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE;gBAC/B,OAAO,KAAK,CAAC;aACd;YACD,MAAM,SAAS,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE;gBACxC,OAAO,KAAK,CAAC;aACd;SACF;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAtED,gDAsEC"}