@cryptexlabs/codex-nodejs-common 0.1.20 → 0.1.21

package/lib/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@cryptexlabs/codex-nodejs-common",
-    "version": "0.1.20",
+    "version": "0.1.21",
     "description": "Common code for Assistant applications",
     "main": "lib/src/index.js",
     "repository": "git@gitlab.com:cryptexlabs/public/codex-nodejs-common.git",

package/lib/src/auth/http-authz.list-sub-objects.guard.util.d.ts

@@ -0,0 +1,10 @@
+import { ExecutionContext } from "@nestjs/common";
+export declare class HttpAuthzListSubObjectsGuardUtil {
+    private readonly context;
+    private _util;
+    constructor(context: ExecutionContext);
+    isAuthorized(object: string, objectId: string, subObject: string, namespace?: string): boolean;
+    get params(): any;
+    get query(): any;
+    get body(): any;
+}

package/lib/src/auth/http-authz.list-sub-objects.guard.util.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpAuthzListSubObjectsGuardUtil = void 0;
+const http_authz_guard_util_1 = require("./http-authz.guard.util");
+class HttpAuthzListSubObjectsGuardUtil {
+    constructor(context) {
+        this.context = context;
+        this._util = new http_authz_guard_util_1.HttpAuthzGuardUtil(context);
+    }
+    isAuthorized(object, objectId, subObject, namespace) {
+        let requests = [];
+        if (namespace) {
+            requests = [
+                {
+                    action: "",
+                    object: namespace,
+                    objectId: "",
+                },
+            ];
+        }
+        requests = [
+            ...requests,
+            {
+                action: "",
+                object,
+                objectId,
+            },
+            {
+                action: "list",
+                object: subObject,
+                objectId: "",
+            },
+        ];
+        return this._util.isAuthorized(...requests);
+    }
+    get params() {
+        return this._util.params;
+    }
+    get query() {
+        return this._util.query;
+    }
+    get body() {
+        return this._util.body;
+    }
+}
+exports.HttpAuthzListSubObjectsGuardUtil = HttpAuthzListSubObjectsGuardUtil;
+//# sourceMappingURL=http-authz.list-sub-objects.guard.util.js.map

package/lib/src/auth/http-authz.list-sub-objects.guard.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-authz.list-sub-objects.guard.util.js","sourceRoot":"","sources":["../../../src/auth/http-authz.list-sub-objects.guard.util.ts"],"names":[],"mappings":";;;AAEA,mEAA6D;AAK7D,MAAa,gCAAgC;IAG3C,YAA6B,OAAyB;QAAzB,YAAO,GAAP,OAAO,CAAkB;QACpD,IAAI,CAAC,KAAK,GAAG,IAAI,0CAAkB,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAQM,YAAY,CACjB,MAAc,EACd,QAAgB,EAChB,SAAiB,EACjB,SAAkB;QAElB,IAAI,QAAQ,GAAG,EAAE,CAAC;QAElB,IAAI,SAAS,EAAE;YACb,QAAQ,GAAG;gBACT;oBACE,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,SAAS;oBACjB,QAAQ,EAAE,EAAE;iBACb;aACF,CAAC;SACH;QAED,QAAQ,GAAG;YACT,GAAG,QAAQ;YACX;gBACE,MAAM,EAAE,EAAE;gBACV,MAAM;gBACN,QAAQ;aACT;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,EAAE;aACb;SACF,CAAC;QAEF,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED,IAAW,MAAM;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3B,CAAC;IAED,IAAW,KAAK;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;IAC1B,CAAC;IAED,IAAW,IAAI;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;CACF;AA3DD,4EA2DC"}

package/lib/src/auth/index.d.ts

@@ -5,3 +5,4 @@ export * from "./http-authz.guard.util";
 export * from "./http-authz.attach-objects.guard.util";
 export * from "./http-authz.detach-objects.guard.util";
 export * from "./http-authz.action-to-sub-objects.guard.util";
+export * from "./http-authz.list-sub-objects.guard.util";

package/lib/src/auth/index.js

@@ -17,4 +17,5 @@ __exportStar(require("./http-authz.guard.util"), exports);
 __exportStar(require("./http-authz.attach-objects.guard.util"), exports);
 __exportStar(require("./http-authz.detach-objects.guard.util"), exports);
 __exportStar(require("./http-authz.action-to-sub-objects.guard.util"), exports);
+__exportStar(require("./http-authz.list-sub-objects.guard.util"), exports);
 //# sourceMappingURL=index.js.map

package/lib/src/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/index.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,4DAA0C;AAC1C,+DAA6C;AAC7C,uDAAqC;AACrC,0DAAwC;AACxC,yEAAuD;AACvD,yEAAuD;AACvD,gFAA8D"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/index.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,4DAA0C;AAC1C,+DAA6C;AAC7C,uDAAqC;AACrC,0DAAwC;AACxC,yEAAuD;AACvD,yEAAuD;AACvD,gFAA8D;AAC9D,2EAAyD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cryptexlabs/codex-nodejs-common",
-  "version": "0.1.20",
+  "version": "0.1.21",
   "description": "Common code for Assistant applications",
   "main": "lib/src/index.js",
   "repository": "git@gitlab.com:cryptexlabs/public/codex-nodejs-common.git",

package/src/auth/http-authz.list-sub-objects.guard.util.spec.ts

@@ -0,0 +1,323 @@
+import { ExecutionContext } from "@nestjs/common";
+import * as jwt from "jsonwebtoken";
+import { HttpAuthzListSubObjectsGuardUtil } from "./http-authz.list-sub-objects.guard.util";
+
+describe(HttpAuthzListSubObjectsGuardUtil.name, () => {
+  it("Should allow super admin to list a group for a user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [`cool-app:::any:any:any:any:any:any`],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+          params: {
+            userId: "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+          },
+          body: ["680dddec-f0b9-4a01-b8b5-be725f946935"],
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzListSubObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        "cool-app"
+      )
+    ).toBe(true);
+  });
+
+  it("Should allow someone with permission to list groups for a user to list a group for the user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [
+          `cool-app:::user:4d2114ca-24e2-43e5-bddb-d9a6688b8340::group:any:list`,
+        ],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzListSubObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        "cool-app"
+      )
+    ).toBe(true);
+  });
+
+  it("Should allow someone with permission to do anything to any group on a user to list a group for the user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [
+          `cool-app:::user:4d2114ca-24e2-43e5-bddb-d9a6688b8340::group:any:any`,
+        ],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+          params: {
+            userId: "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+          },
+          body: ["680dddec-f0b9-4a01-b8b5-be725f946935"],
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzListSubObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        "cool-app"
+      )
+    ).toBe(true);
+  });
+
+  it("Should allow someone with permission to do anything to any sub object for a user to list a group for the user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [
+          `cool-app:::user:4d2114ca-24e2-43e5-bddb-d9a6688b8340::any:any:any`,
+        ],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+          params: {
+            userId: "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+          },
+          body: ["680dddec-f0b9-4a01-b8b5-be725f946935"],
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzListSubObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        "cool-app"
+      )
+    ).toBe(true);
+  });
+
+  it("Should allow someone with permission to list a specific group for a user to list the groups to the user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [
+          `cool-app:::user:4d2114ca-24e2-43e5-bddb-d9a6688b8340::group::list`,
+        ],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+          params: {
+            userId: "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+          },
+          body: ["680dddec-f0b9-4a01-b8b5-be725f946935"],
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzListSubObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        "cool-app"
+      )
+    ).toBe(true);
+  });
+
+  it("Should not allow someone with permission to list groups to a different user to list a group for the user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [
+          `cool-app:::user:55854a66-5a73-4416-b03a-eba4417b691c::group:any:create`,
+        ],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+          params: {
+            userId: "001d4f53-798b-4a0b-8ef7-330a7bf72147",
+          },
+          body: ["680dddec-f0b9-4a01-b8b5-be725f946935"],
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzListSubObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        "cool-app"
+      )
+    ).toBe(false);
+  });
+
+  it("Should not allow someone with permission to do anything to a different user to list a group for the user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [
+          `cool-app:::user:55854a66-5a73-4416-b03a-eba4417b691c::group:any:any`,
+        ],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+          params: {
+            userId: "001d4f53-798b-4a0b-8ef7-330a7bf72147",
+          },
+          body: ["680dddec-f0b9-4a01-b8b5-be725f946935"],
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzListSubObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        "cool-app"
+      )
+    ).toBe(false);
+  });
+
+  it("Should not allow someone with permission to do anything to any sub object for a different user to list a group for the user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [
+          `cool-app:::user:55854a66-5a73-4416-b03a-eba4417b691c::any:any:any`,
+        ],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+          params: {
+            userId: "001d4f53-798b-4a0b-8ef7-330a7bf72147",
+          },
+          body: ["680dddec-f0b9-4a01-b8b5-be725f946935"],
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzListSubObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        "cool-app"
+      )
+    ).toBe(false);
+  });
+
+  it("Should not allow someone with permission to list a different specific permission for a user to list the groups to the user", () => {
+    const token = jwt.sign(
+      {
+        scopes: [
+          `cool-app:::user:4d2114ca-24e2-43e5-bddb-d9a6688b8340::group:any:create`,
+        ],
+      },
+      "hello"
+    );
+
+    const context = {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: {
+            authorization: `Bearer ${token}`,
+          },
+          params: {
+            userId: "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+          },
+          body: ["5be3176f-c066-4418-b682-18e16fd07b84"],
+        }),
+      }),
+    } as ExecutionContext;
+
+    const util = new HttpAuthzListSubObjectsGuardUtil(context);
+
+    expect(
+      util.isAuthorized(
+        "user",
+        "4d2114ca-24e2-43e5-bddb-d9a6688b8340",
+        "group",
+        "cool-app"
+      )
+    ).toBe(false);
+  });
+});

package/src/auth/http-authz.list-sub-objects.guard.util.ts

@@ -0,0 +1,67 @@
+import { ExecutionContext } from "@nestjs/common";
+import { HttpAuthzActionToSubObjectsGuardUtil } from "./http-authz.action-to-sub-objects.guard.util";
+import { HttpAuthzGuardUtil } from "./http-authz.guard.util";
+
+/**
+ * Authorizes detachment of objects to another object by object id
+ */
+export class HttpAuthzListSubObjectsGuardUtil {
+  private _util: HttpAuthzGuardUtil;
+
+  constructor(private readonly context: ExecutionContext) {
+    this._util = new HttpAuthzGuardUtil(context);
+  }
+
+  /**
+   * @param {string} object The object name of object A
+   * @param {string} objectId The object ID of object A
+   * @param {string} detachObject The object name of objects B
+   * @param {string?} namespace (Optional) The namespace of objects A and B
+   */
+  public isAuthorized(
+    object: string,
+    objectId: string,
+    subObject: string,
+    namespace?: string
+  ) {
+    let requests = [];
+
+    if (namespace) {
+      requests = [
+        {
+          action: "",
+          object: namespace,
+          objectId: "",
+        },
+      ];
+    }
+
+    requests = [
+      ...requests,
+      {
+        action: "",
+        object,
+        objectId,
+      },
+      {
+        action: "list",
+        object: subObject,
+        objectId: "",
+      },
+    ];
+
+    return this._util.isAuthorized(...requests);
+  }
+
+  public get params() {
+    return this._util.params;
+  }
+
+  public get query() {
+    return this._util.query;
+  }
+
+  public get body() {
+    return this._util.body;
+  }
+}

package/src/auth/index.ts

@@ -5,3 +5,4 @@ export * from "./http-authz.guard.util";
 export * from "./http-authz.attach-objects.guard.util";
 export * from "./http-authz.detach-objects.guard.util";
 export * from "./http-authz.action-to-sub-objects.guard.util";
+export * from "./http-authz.list-sub-objects.guard.util";