@develit-services/rbac 0.2.2 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (16) hide show
  1. package/dist/export/worker.cjs +312 -41
  2. package/dist/export/worker.d.cts +13 -6
  3. package/dist/export/worker.d.mts +13 -6
  4. package/dist/export/worker.d.ts +13 -6
  5. package/dist/export/worker.mjs +312 -42
  6. package/dist/shared/{rbac.DB0xguAY.d.cts → rbac.B4wUvd3l.d.cts} +2 -2
  7. package/dist/shared/{rbac.B2KUW5xp.cjs → rbac.BZDCYlSt.cjs} +7 -5
  8. package/dist/shared/{rbac.CocWK7y6.d.mts → rbac.DbnJpvqK.d.mts} +2 -2
  9. package/dist/shared/{rbac.CAcqvrNj.d.ts → rbac.DrhiDe1P.d.ts} +2 -2
  10. package/dist/shared/{rbac.CUCczegz.mjs → rbac.ihzxYB9Z.mjs} +7 -5
  11. package/dist/types.cjs +1 -1
  12. package/dist/types.d.cts +1 -1
  13. package/dist/types.d.mts +1 -1
  14. package/dist/types.d.ts +1 -1
  15. package/dist/types.mjs +1 -1
  16. package/package.json +1 -1
package/dist/export/worker.cjs CHANGED
@@ -5,7 +5,7 @@ Object.defineProperty(exports, '__esModule', { value: true });
5
5
  const backendSdk = require('@develit-io/backend-sdk');
6
6
  const database_schema = require('../shared/rbac.Cra1T2nC.cjs');
7
7
  const drizzleOrm = require('drizzle-orm');
8
- const verifyScope = require('../shared/rbac.B2KUW5xp.cjs');
8
+ const verifyScope = require('../shared/rbac.BZDCYlSt.cjs');
9
9
  const zod = require('zod');
10
10
  const cloudflare_workers = require('cloudflare:workers');
11
11
  const d1 = require('drizzle-orm/d1');
@@ -658,12 +658,13 @@ let RbacServiceBase = class extends backendSdk.develitWorker(cloudflare_workers.
658
658
  }
659
659
  async verifyAccess(input) {
660
660
  return this.handleAction(
661
- // TODO: This input schema is just copied from auth and is not 100% type safe
662
661
  { data: input, schema: verifyScope.verifyAccessInputSchema },
663
662
  { successMessage: "Access verification completed." },
664
663
  async ({ userId, accessRequests, jwt }) => {
665
- for (const request of accessRequests) {
666
- this.validateScope(request.scope);
664
+ for (const requestGroup of accessRequests) {
665
+ for (const request of requestGroup) {
666
+ this.validateScope(request.scope);
667
+ }
667
668
  }
668
669
  const userPermissionsResponse = await this.getUserPermissions({
669
670
  userId
@@ -678,46 +679,55 @@ let RbacServiceBase = class extends backendSdk.develitWorker(cloudflare_workers.
678
679
  ...userPermissionsResponse.data.roleScopes,
679
680
  ...userPermissionsResponse.data.scopes
680
681
  ];
681
- const allAccessRequestsSatisfied = accessRequests.every((request) => {
682
- const placeholders = parseScopeTemplate(request.scope);
683
- return allScopes.some((userScope) => {
684
- const scopesMatch = userScope.scope === request.scope;
685
- let resourceMatches = false;
686
- if (placeholders.length > 0) {
687
- if (!request.resourcePath) {
688
- throw backendSdk.createInternalError(null, {
689
- message: `Resource path is required when scope '${request.scope}' contains placeholders`,
690
- status: 400,
691
- code: "RESOURCE_PATH_REQUIRED"
692
- });
693
- }
694
- const extractedResources = extractResourcesFromPath(
695
- request.scope,
696
- request.resourcePath
697
- );
698
- const allPlaceholdersMatch = placeholders.every((placeholder) => {
699
- const extractedValue = extractedResources[`${placeholder.type}.${placeholder.path}`];
700
- const jwtParam = placeholder.type === "jwt" ? jwt : void 0;
701
- const expectedValue = getValueByKey(
702
- placeholder.type,
703
- placeholder.path,
704
- jwtParam
705
- );
706
- if (expectedValue === void 0) {
707
- return false;
682
+ if (accessRequests.length === 0) {
683
+ return {
684
+ isVerified: true
685
+ };
686
+ }
687
+ const anyGroupSatisfied = accessRequests.some((requestGroup) => {
688
+ return requestGroup.every((request) => {
689
+ const placeholders = parseScopeTemplate(request.scope);
690
+ return allScopes.some((userScope) => {
691
+ const scopesMatch = userScope.scope === request.scope;
692
+ let resourceMatches = false;
693
+ if (placeholders.length > 0) {
694
+ if (!request.resourcePath) {
695
+ throw backendSdk.createInternalError(null, {
696
+ message: `Resource path is required when scope '${request.scope}' contains placeholders`,
697
+ status: 400,
698
+ code: "RESOURCE_PATH_REQUIRED"
699
+ });
708
700
  }
709
- return String(extractedValue) === String(expectedValue);
710
- });
711
- const resourceIdMatches = userScope.resourceId === null || userScope.resourceId === request.resourceId;
712
- resourceMatches = allPlaceholdersMatch && resourceIdMatches;
713
- } else {
714
- resourceMatches = userScope.resourceId === null || userScope.resourceId === request.resourceId;
715
- }
716
- return scopesMatch && resourceMatches;
701
+ const extractedResources = extractResourcesFromPath(
702
+ request.scope,
703
+ request.resourcePath
704
+ );
705
+ const allPlaceholdersMatch = placeholders.every(
706
+ (placeholder) => {
707
+ const extractedValue = extractedResources[`${placeholder.type}.${placeholder.path}`];
708
+ const jwtParam = placeholder.type === "jwt" ? jwt : void 0;
709
+ const expectedValue = getValueByKey(
710
+ placeholder.type,
711
+ placeholder.path,
712
+ jwtParam
713
+ );
714
+ if (expectedValue === void 0) {
715
+ return false;
716
+ }
717
+ return String(extractedValue) === String(expectedValue);
718
+ }
719
+ );
720
+ const resourceIdMatches = userScope.resourceId === null || userScope.resourceId === request.resourceId;
721
+ resourceMatches = allPlaceholdersMatch && resourceIdMatches;
722
+ } else {
723
+ resourceMatches = userScope.resourceId === null || userScope.resourceId === request.resourceId;
724
+ }
725
+ return scopesMatch && resourceMatches;
726
+ });
717
727
  });
718
728
  });
719
729
  return {
720
- isVerified: allAccessRequestsSatisfied
730
+ isVerified: anyGroupSatisfied
721
731
  };
722
732
  }
723
733
  );
@@ -798,7 +808,268 @@ function defineRbacService(config = { scopes: [] }) {
798
808
  };
799
809
  }
800
810
 
801
- const RbacService = defineRbacService();
811
+ const organizationScopedKeys = (scopes) => {
812
+ const out = scopes.map((scope) => {
813
+ const [prefix, ...rest] = scope.split(".");
814
+ return `${prefix}.{jwt.user.rawUserMetaData.organizationId}.${rest.join(".")}`;
815
+ });
816
+ return out;
817
+ };
818
+ const TEST_SCOPES = [
819
+ "test.read",
820
+ "test.edit",
821
+ "test.delete",
822
+ "test.{jwt.organizationId}.read",
823
+ "test.{jwt.user.rawUserMetaData.organizationId}.read",
824
+ "test.{jwt.user.rawUserMetaData.organizationId}.edit",
825
+ "test.{param.resourceId}.read",
826
+ "test.organization.{jwt.user.rawUserMetaData.organizationId}.resource.{jwt.user.rawUserMetaData.organizationId}.read",
827
+ "test.organization.{jwt.user.rawUserMetaData.organizationId}.branch.{jwt.userData.organizationBranchId}.read",
828
+ "test.{invalid}.scope",
829
+ "test.{}.scope",
830
+ "test.{jwt.}.scope",
831
+ "test.{.key}.scope"
832
+ ];
833
+ const TICKET_SCOPES = [
834
+ "tickets.read",
835
+ "tickets.create",
836
+ "tickets.edit",
837
+ "tickets.delete",
838
+ "tickets.archive",
839
+ "tickets.automations.pause",
840
+ "tickets.automations.resume",
841
+ "tickets.dependencies.read",
842
+ "tickets.dependencies.create",
843
+ "tickets.dependencies.edit",
844
+ "tickets.dependencies.delete",
845
+ "tickets.confirmation.send",
846
+ "tickets.confirmation.download",
847
+ "tickets.payments.create",
848
+ "tickets.payments.read",
849
+ "tickets.payments.edit",
850
+ "tickets.payments.delete",
851
+ "tickets.payments.confirmation.send",
852
+ "tickets.payments.confirmation.download",
853
+ "tickets.logs.read",
854
+ "tickets.logs.create",
855
+ "tickets.logs.delete"
856
+ ];
857
+ const CLIENT_SCOPES = [
858
+ "clients.read",
859
+ "clients.create",
860
+ "clients.edit",
861
+ "clients.delete",
862
+ "clients.pin.read",
863
+ // if not - gw returns **** for pin
864
+ "clients.pin.edit",
865
+ // if not - fe should not allow pin change
866
+ "clients.trader.edit",
867
+ "clients.logs.read",
868
+ "clients.logs.create",
869
+ "clients.logs.delete"
870
+ ];
871
+ const USER_SCOPES = [
872
+ "users.read",
873
+ "users.create",
874
+ "users.edit",
875
+ "users.delete",
876
+ "users.ban",
877
+ "users.password.reset.send",
878
+ "users.password.edit",
879
+ "users.2fa.enable",
880
+ "users.2fa.disable",
881
+ "users.roles.read",
882
+ "users.roles.edit",
883
+ "users.scopes.read",
884
+ "users.scopes.assign",
885
+ "users.scopes.delete",
886
+ "users.logs.read",
887
+ "users.logs.create",
888
+ "users.logs.delete"
889
+ ];
890
+ [
891
+ // Ticket scopes
892
+ ...TICKET_SCOPES,
893
+ ...organizationScopedKeys(TICKET_SCOPES),
894
+ // Client scopes
895
+ ...CLIENT_SCOPES,
896
+ ...organizationScopedKeys(CLIENT_SCOPES),
897
+ // User scopes
898
+ ...USER_SCOPES,
899
+ ...organizationScopedKeys(USER_SCOPES),
900
+ // Trader scopes
901
+ "traders.read",
902
+ "traders.create",
903
+ "traders.edit",
904
+ "traders.delete",
905
+ "traders.logs",
906
+ // Role scopes
907
+ "roles.read",
908
+ "roles.create",
909
+ "roles.edit",
910
+ "roles.delete",
911
+ "roles.scopes.assign",
912
+ // assign scopes to roles
913
+ "roles.scopes.delete",
914
+ // delete scopes from roles
915
+ "roles.logs.read",
916
+ "roles.logs.create",
917
+ "roles.logs.delete",
918
+ "roles.users.read",
919
+ // read users assigned to roles
920
+ // Ledger scopes
921
+ // 'accounts.read',
922
+ // 'accounts.create',
923
+ // 'accounts.edit',
924
+ // 'accounts.delete',
925
+ // 'accounts.archive',
926
+ // 'accounts.balance',
927
+ // 'accounts.identifiers.create',
928
+ // 'accounts.identifiers.read',
929
+ // 'accounts.identifiers.edit',
930
+ // 'accounts.identifiers.delete',
931
+ // 'accounts.transactions.read',
932
+ // 'accounts.logs.read',
933
+ // 'accounts.logs.create',
934
+ // 'accounts.logs.delete',
935
+ ...TEST_SCOPES
936
+ ];
937
+ const LABELED_SCOPES = [
938
+ { label: "Zobrazit tikety", value: "tickets.read" },
939
+ {
940
+ label: "Zobrazit tikety v r\xE1mci organizace",
941
+ value: "tickets.{jwt.user.rawUserMetaData.organizationId}.read"
942
+ },
943
+ { label: "Vytvo\u0159it tiket", value: "tickets.create" },
944
+ { label: "Upravit tiket", value: "tickets.edit" },
945
+ { label: "Smazat tiket", value: "tickets.delete" },
946
+ { label: "Archivovat tiket", value: "tickets.archive" },
947
+ {
948
+ label: "Pozastavit automatizaci tiketu",
949
+ value: "tickets.automations.pause"
950
+ },
951
+ { label: "Obnovit automatizaci tiketu", value: "tickets.automations.resume" },
952
+ { label: "Zobrazit z\xE1vislosti tiket\u016F", value: "tickets.dependencies.read" },
953
+ { label: "Vytvo\u0159it z\xE1vislosti tiket\u016F", value: "tickets.dependencies.create" },
954
+ { label: "Upravit z\xE1vislosti tiket\u016F", value: "tickets.dependencies.edit" },
955
+ { label: "Smazat z\xE1vislosti tiket\u016F", value: "tickets.dependencies.delete" },
956
+ { label: "Poslat potvrzen\xED tiketu", value: "tickets.confirmation.send" },
957
+ {
958
+ label: "St\xE1hnout potvrzen\xED tiketu",
959
+ value: "tickets.confirmation.download"
960
+ },
961
+ { label: "Vytvo\u0159it platbu tiketu", value: "tickets.payments.create" },
962
+ { label: "Zobrazit platby tiketu", value: "tickets.payments.read" },
963
+ { label: "Upravit platby tiketu", value: "tickets.payments.edit" },
964
+ { label: "Smazat platby tiketu", value: "tickets.payments.delete" },
965
+ {
966
+ label: "Poslat potvrzen\xED platby tiketu",
967
+ value: "tickets.payments.confirmation.send"
968
+ },
969
+ {
970
+ label: "St\xE1hnout potvrzen\xED platby tiketu",
971
+ value: "tickets.payments.confirmation.download"
972
+ },
973
+ { label: "Zobrazit logy tiketu", value: "tickets.logs.read" },
974
+ { label: "Vytvo\u0159it logy tiketu", value: "tickets.logs.create" },
975
+ { label: "Smazat logy tiketu", value: "tickets.logs.delete" },
976
+ { label: "Zobrazit obchodn\xEDky", value: "traders.read" },
977
+ { label: "Vytvo\u0159it obchodn\xEDky", value: "traders.create" },
978
+ { label: "Upravit obchodn\xEDky", value: "traders.edit" },
979
+ { label: "Smazat obchodn\xEDky", value: "traders.delete" },
980
+ { label: "Logy obchodn\xEDk\u016F", value: "traders.logs" },
981
+ { label: "Zobrazit klienty", value: "clients.read" },
982
+ { label: "Vytvo\u0159it klienty", value: "clients.create" },
983
+ { label: "Upravit klienty", value: "clients.edit" },
984
+ { label: "Smazat klienty", value: "clients.delete" },
985
+ { label: "Zobrazit PIN klienta", value: "clients.pin.read" },
986
+ { label: "Upravit PIN klienta", value: "clients.pin.edit" },
987
+ // { label: 'Zobrazit limity klienta', value: 'clients.limits.read' },
988
+ // { label: 'Upravit limity klienta', value: 'clients.limits.edit' },
989
+ // { label: 'Přiřadit obchodníka klientovi', value: 'clients.trader.assign' },
990
+ { label: "Upravit obchodn\xEDka klienta", value: "clients.trader.edit" },
991
+ { label: "Zobrazit logy klient\u016F", value: "clients.logs.read" },
992
+ { label: "Vytvo\u0159it logy klient\u016F", value: "clients.logs.create" },
993
+ { label: "Smazat logy klient\u016F", value: "clients.logs.delete" },
994
+ { label: "Zobrazit u\u017Eivatele", value: "users.read" },
995
+ { label: "Vytvo\u0159it u\u017Eivatele", value: "users.create" },
996
+ { label: "Upravit u\u017Eivatele", value: "users.edit" },
997
+ { label: "Smazat u\u017Eivatele", value: "users.delete" },
998
+ // { label: 'Archivovat uživatele', value: 'users.archive' },
999
+ { label: "Poslat reset hesla", value: "users.password.reset.send" },
1000
+ // { label: 'Zobrazit oprávnění uživatelů', value: 'users.permissions.read' },
1001
+ // { label: 'Přiřadit oprávnění uživatelům', value: 'users.permissions.assign' },
1002
+ // { label: 'Odebrat oprávnění uživatelům', value: 'users.permissions.delete' },
1003
+ { label: "Povolit 2FA u\u017Eivatel\u016Fm", value: "users.2fa.enable" },
1004
+ { label: "Zak\xE1zat 2FA u\u017Eivatel\u016Fm", value: "users.2fa.disable" },
1005
+ { label: "Zobrazit logy u\u017Eivatel\u016F", value: "users.logs.read" },
1006
+ { label: "Vytvo\u0159it logy u\u017Eivatel\u016F", value: "users.logs.create" },
1007
+ { label: "Smazat logy u\u017Eivatel\u016F", value: "users.logs.delete" },
1008
+ { label: "Zobrazit role", value: "roles.read" },
1009
+ { label: "Vytvo\u0159it role", value: "roles.create" },
1010
+ { label: "Upravit role", value: "roles.edit" },
1011
+ { label: "Smazat role", value: "roles.delete" },
1012
+ // { label: 'Přiřadit oprávnění rolím', value: 'roles.permissions.assign' },
1013
+ // { label: 'Odebrat oprávnění rolím', value: 'roles.permissions.delete' },
1014
+ { label: "Zobrazit logy rol\xED", value: "roles.logs.read" },
1015
+ { label: "Vytvo\u0159it logy rol\xED", value: "roles.logs.create" },
1016
+ { label: "Smazat logy rol\xED", value: "roles.logs.delete" },
1017
+ { label: "Zobrazit u\u017Eivatele p\u0159i\u0159azen\xE9 k rol\xEDm", value: "roles.users.read" },
1018
+ // Test scopes
1019
+ { label: "Test: Read", value: "test.read" },
1020
+ { label: "Test: Edit", value: "test.edit" },
1021
+ { label: "Test: Delete", value: "test.delete" },
1022
+ {
1023
+ label: "Test: Organization ID Read (JWT - invalid path)",
1024
+ value: "test.{jwt.organizationId}.read"
1025
+ },
1026
+ {
1027
+ label: "Test: Organization Read (JWT)",
1028
+ value: "test.{jwt.user.rawUserMetaData.organizationId}.read"
1029
+ },
1030
+ {
1031
+ label: "Test: Organization Edit (JWT)",
1032
+ value: "test.{jwt.user.rawUserMetaData.organizationId}.edit"
1033
+ },
1034
+ {
1035
+ label: "Test: Resource Read (Param)",
1036
+ value: "test.{param.resourceId}.read"
1037
+ },
1038
+ {
1039
+ label: "Test: Organization Resource Read (Multiple JWT placeholders)",
1040
+ value: "test.organization.{jwt.user.rawUserMetaData.organizationId}.resource.{jwt.user.rawUserMetaData.organizationId}.read"
1041
+ },
1042
+ {
1043
+ label: "Test: Organization Branch Read (JWT userData)",
1044
+ value: "test.organization.{jwt.user.rawUserMetaData.organizationId}.branch.{jwt.userData.organizationBranchId}.read"
1045
+ },
1046
+ { label: "Test: Invalid placeholder format", value: "test.{invalid}.scope" },
1047
+ { label: "Test: Empty placeholder", value: "test.{}.scope" },
1048
+ { label: "Test: Empty key placeholder", value: "test.{jwt.}.scope" },
1049
+ { label: "Test: Empty type placeholder", value: "test.{.key}.scope" }
1050
+ // { label: 'Zobrazit účty', value: 'accounts.read' },
1051
+ // { label: 'Vytvořit účty', value: 'accounts.create' },
1052
+ // { label: 'Upravit účty', value: 'accounts.edit' },
1053
+ // { label: 'Smazat účty', value: 'accounts.delete' },
1054
+ // { label: 'Archivovat účty', value: 'accounts.archive' },
1055
+ // { label: 'Zobrazit zůstatek účtu', value: 'accounts.balance' },
1056
+ // {
1057
+ // label: 'Vytvořit identifikátory účtu',
1058
+ // value: 'accounts.identifiers.create',
1059
+ // },
1060
+ // { label: 'Zobrazit identifikátory účtu', value: 'accounts.identifiers.read' },
1061
+ // { label: 'Upravit identifikátory účtu', value: 'accounts.identifiers.edit' },
1062
+ // { label: 'Smazat identifikátory účtu', value: 'accounts.identifiers.delete' },
1063
+ // { label: 'Zobrazit transakce účtu', value: 'accounts.transactions.read' },
1064
+ // { label: 'Zobrazit logy účtů', value: 'accounts.logs.read' },
1065
+ // { label: 'Vytvořit logy účtů', value: 'accounts.logs.create' },
1066
+ // { label: 'Smazat logy účtů', value: 'accounts.logs.delete' },
1067
+ ];
1068
+
1069
+ const RbacService = defineRbacService({
1070
+ scopes: LABELED_SCOPES
1071
+ });
802
1072
 
1073
+ exports.LABELED_SCOPES = LABELED_SCOPES;
803
1074
  exports.default = RbacService;
804
1075
  exports.defineRbacService = defineRbacService;
package/dist/export/worker.d.cts CHANGED
@@ -1,6 +1,6 @@
1
1
  import * as _develit_io_backend_sdk from '@develit-io/backend-sdk';
2
2
  import { IRPCResponse } from '@develit-io/backend-sdk';
3
- import { L as LabeledScope, t as tables, C as CreateRoleInput, a as CreateRoleOutput, A as AssignRoleToUserInput, b as AssignRoleToUserOutput, c as AssignRolesToUserInput, d as AssignRolesToUserOutput, R as RevokeRoleFromUserInput, e as RevokeRoleFromUserOutput, G as GrantScopeToUserInput, f as GrantScopeToUserOutput, g as GrantScopesToUserInput, h as GrantScopesToUserOutput, i as RevokeScopeFromUserInput, j as RevokeScopeFromUserOutput, k as GrantScopeToRoleInput, l as GrantScopeToRoleOutput, m as RevokeScopeFromRoleInput, n as RevokeScopeFromRoleOutput, o as GetPermissionsOutput, p as GetUserPermissionsInput, q as GetUserPermissionsOutput, V as VerifyAccessInput, r as VerifyAccessOutput, D as DeleteRoleInput, s as DeleteRoleOutput, U as UpdateRoleInput, u as UpdateRoleOutput } from '../shared/rbac.DB0xguAY.cjs';
3
+ import { L as LabeledScope$1, t as tables, C as CreateRoleInput, a as CreateRoleOutput, A as AssignRoleToUserInput, b as AssignRoleToUserOutput, c as AssignRolesToUserInput, d as AssignRolesToUserOutput, R as RevokeRoleFromUserInput, e as RevokeRoleFromUserOutput, G as GrantScopeToUserInput, f as GrantScopeToUserOutput, g as GrantScopesToUserInput, h as GrantScopesToUserOutput, i as RevokeScopeFromUserInput, j as RevokeScopeFromUserOutput, k as GrantScopeToRoleInput, l as GrantScopeToRoleOutput, m as RevokeScopeFromRoleInput, n as RevokeScopeFromRoleOutput, o as GetPermissionsOutput, p as GetUserPermissionsInput, q as GetUserPermissionsOutput, V as VerifyAccessInput, r as VerifyAccessOutput, D as DeleteRoleInput, s as DeleteRoleOutput, U as UpdateRoleInput, u as UpdateRoleOutput } from '../shared/rbac.B4wUvd3l.cjs';
4
4
  import { WorkerEntrypoint } from 'cloudflare:workers';
5
5
  import { DrizzleD1Database } from 'drizzle-orm/d1';
6
6
  import 'zod';
@@ -9,7 +9,7 @@ import '../shared/rbac.CqpxM3E5.cjs';
9
9
  import 'drizzle-orm/sqlite-core';
10
10
 
11
11
  declare const RbacServiceBase_base: (abstract new (ctx: ExecutionContext, env: RbacEnv) => WorkerEntrypoint<RbacEnv, {}>) & (abstract new (...args: any[]) => _develit_io_backend_sdk.DevelitWorkerMethods);
12
- declare class RbacServiceBase<TScopes extends readonly LabeledScope[] = LabeledScope[]> extends RbacServiceBase_base {
12
+ declare class RbacServiceBase<TScopes extends readonly LabeledScope$1[] = LabeledScope$1[]> extends RbacServiceBase_base {
13
13
  readonly db: DrizzleD1Database<typeof tables>;
14
14
  readonly SCOPES: TScopes;
15
15
  constructor(ctx: ExecutionContext, env: RbacEnv, scopes: TScopes);
@@ -26,21 +26,28 @@ declare class RbacServiceBase<TScopes extends readonly LabeledScope[] = LabeledS
26
26
  getPermissions(): Promise<IRPCResponse<GetPermissionsOutput>>;
27
27
  getUserPermissions(input: GetUserPermissionsInput): Promise<IRPCResponse<GetUserPermissionsOutput>>;
28
28
  verifyAccess(input: Omit<VerifyAccessInput, 'accessRequests'> & {
29
- accessRequests: Array<{
29
+ accessRequests: Array<Array<{
30
30
  scope: TScopes[number]['value'];
31
31
  resourceId?: string;
32
32
  resourcePath?: string;
33
- }>;
33
+ }>>;
34
34
  }): Promise<IRPCResponse<VerifyAccessOutput>>;
35
35
  deleteRole(input: DeleteRoleInput): Promise<IRPCResponse<DeleteRoleOutput>>;
36
36
  updateRole(input: UpdateRoleInput): Promise<IRPCResponse<UpdateRoleOutput>>;
37
37
  }
38
- declare function defineRbacService<const TScopes extends readonly LabeledScope[]>(config?: {
38
+ declare function defineRbacService<const TScopes extends readonly LabeledScope$1[]>(config?: {
39
39
  scopes: TScopes;
40
40
  }): new (ctx: ExecutionContext, env: RbacEnv) => RbacServiceBase<TScopes>;
41
41
 
42
+ declare const SCOPES: readonly ["tickets.read", "tickets.create", "tickets.edit", "tickets.delete", "tickets.archive", "tickets.automations.pause", "tickets.automations.resume", "tickets.dependencies.read", "tickets.dependencies.create", "tickets.dependencies.edit", "tickets.dependencies.delete", "tickets.confirmation.send", "tickets.confirmation.download", "tickets.payments.create", "tickets.payments.read", "tickets.payments.edit", "tickets.payments.delete", "tickets.payments.confirmation.send", "tickets.payments.confirmation.download", "tickets.logs.read", "tickets.logs.create", "tickets.logs.delete", "tickets.{jwt.user.rawUserMetaData.organizationId}.read", "tickets.{jwt.user.rawUserMetaData.organizationId}.create", "tickets.{jwt.user.rawUserMetaData.organizationId}.edit", "tickets.{jwt.user.rawUserMetaData.organizationId}.delete", "tickets.{jwt.user.rawUserMetaData.organizationId}.archive", "tickets.{jwt.user.rawUserMetaData.organizationId}.automations.pause", "tickets.{jwt.user.rawUserMetaData.organizationId}.automations.resume", "tickets.{jwt.user.rawUserMetaData.organizationId}.dependencies.read", "tickets.{jwt.user.rawUserMetaData.organizationId}.dependencies.create", "tickets.{jwt.user.rawUserMetaData.organizationId}.dependencies.edit", "tickets.{jwt.user.rawUserMetaData.organizationId}.dependencies.delete", "tickets.{jwt.user.rawUserMetaData.organizationId}.confirmation.send", "tickets.{jwt.user.rawUserMetaData.organizationId}.confirmation.download", "tickets.{jwt.user.rawUserMetaData.organizationId}.payments.create", "tickets.{jwt.user.rawUserMetaData.organizationId}.payments.read", "tickets.{jwt.user.rawUserMetaData.organizationId}.payments.edit", "tickets.{jwt.user.rawUserMetaData.organizationId}.payments.delete", "tickets.{jwt.user.rawUserMetaData.organizationId}.payments.confirmation.send", "tickets.{jwt.user.rawUserMetaData.organizationId}.payments.confirmation.download", "tickets.{jwt.user.rawUserMetaData.organizationId}.logs.read", "tickets.{jwt.user.rawUserMetaData.organizationId}.logs.create", "tickets.{jwt.user.rawUserMetaData.organizationId}.logs.delete", "clients.read", "clients.create", "clients.edit", "clients.delete", "clients.pin.read", "clients.pin.edit", "clients.trader.edit", "clients.logs.read", "clients.logs.create", "clients.logs.delete", "clients.{jwt.user.rawUserMetaData.organizationId}.read", "clients.{jwt.user.rawUserMetaData.organizationId}.create", "clients.{jwt.user.rawUserMetaData.organizationId}.edit", "clients.{jwt.user.rawUserMetaData.organizationId}.delete", "clients.{jwt.user.rawUserMetaData.organizationId}.pin.read", "clients.{jwt.user.rawUserMetaData.organizationId}.pin.edit", "clients.{jwt.user.rawUserMetaData.organizationId}.trader.edit", "clients.{jwt.user.rawUserMetaData.organizationId}.logs.read", "clients.{jwt.user.rawUserMetaData.organizationId}.logs.create", "clients.{jwt.user.rawUserMetaData.organizationId}.logs.delete", "users.read", "users.create", "users.edit", "users.delete", "users.ban", "users.password.reset.send", "users.password.edit", "users.2fa.enable", "users.2fa.disable", "users.roles.read", "users.roles.edit", "users.scopes.read", "users.scopes.assign", "users.scopes.delete", "users.logs.read", "users.logs.create", "users.logs.delete", "users.{jwt.user.rawUserMetaData.organizationId}.read", "users.{jwt.user.rawUserMetaData.organizationId}.create", "users.{jwt.user.rawUserMetaData.organizationId}.edit", "users.{jwt.user.rawUserMetaData.organizationId}.delete", "users.{jwt.user.rawUserMetaData.organizationId}.ban", "users.{jwt.user.rawUserMetaData.organizationId}.password.reset.send", "users.{jwt.user.rawUserMetaData.organizationId}.password.edit", "users.{jwt.user.rawUserMetaData.organizationId}.2fa.enable", "users.{jwt.user.rawUserMetaData.organizationId}.2fa.disable", "users.{jwt.user.rawUserMetaData.organizationId}.roles.read", "users.{jwt.user.rawUserMetaData.organizationId}.roles.edit", "users.{jwt.user.rawUserMetaData.organizationId}.scopes.read", "users.{jwt.user.rawUserMetaData.organizationId}.scopes.assign", "users.{jwt.user.rawUserMetaData.organizationId}.scopes.delete", "users.{jwt.user.rawUserMetaData.organizationId}.logs.read", "users.{jwt.user.rawUserMetaData.organizationId}.logs.create", "users.{jwt.user.rawUserMetaData.organizationId}.logs.delete", "traders.read", "traders.create", "traders.edit", "traders.delete", "traders.logs", "roles.read", "roles.create", "roles.edit", "roles.delete", "roles.scopes.assign", "roles.scopes.delete", "roles.logs.read", "roles.logs.create", "roles.logs.delete", "roles.users.read", "test.read", "test.edit", "test.delete", "test.{jwt.organizationId}.read", "test.{jwt.user.rawUserMetaData.organizationId}.read", "test.{jwt.user.rawUserMetaData.organizationId}.edit", "test.{param.resourceId}.read", "test.organization.{jwt.user.rawUserMetaData.organizationId}.resource.{jwt.user.rawUserMetaData.organizationId}.read", "test.organization.{jwt.user.rawUserMetaData.organizationId}.branch.{jwt.userData.organizationBranchId}.read", "test.{invalid}.scope", "test.{}.scope", "test.{jwt.}.scope", "test.{.key}.scope"];
43
+ type LabeledScope = {
44
+ label: string;
45
+ value: (typeof SCOPES)[number];
46
+ };
47
+ declare const LABELED_SCOPES: LabeledScope[];
48
+
42
49
  declare const _default: new (ctx: ExecutionContext, env: RbacEnv) => WorkerEntrypoint<RbacEnv>;
43
50
 
44
51
  // @ts-ignore
45
52
  export = _default;
46
- export { defineRbacService };
53
+ export { LABELED_SCOPES, defineRbacService };
package/dist/export/worker.d.mts CHANGED
@@ -1,6 +1,6 @@
1
1
  import * as _develit_io_backend_sdk from '@develit-io/backend-sdk';
2
2
  import { IRPCResponse } from '@develit-io/backend-sdk';
3
- import { L as LabeledScope, t as tables, C as CreateRoleInput, a as CreateRoleOutput, A as AssignRoleToUserInput, b as AssignRoleToUserOutput, c as AssignRolesToUserInput, d as AssignRolesToUserOutput, R as RevokeRoleFromUserInput, e as RevokeRoleFromUserOutput, G as GrantScopeToUserInput, f as GrantScopeToUserOutput, g as GrantScopesToUserInput, h as GrantScopesToUserOutput, i as RevokeScopeFromUserInput, j as RevokeScopeFromUserOutput, k as GrantScopeToRoleInput, l as GrantScopeToRoleOutput, m as RevokeScopeFromRoleInput, n as RevokeScopeFromRoleOutput, o as GetPermissionsOutput, p as GetUserPermissionsInput, q as GetUserPermissionsOutput, V as VerifyAccessInput, r as VerifyAccessOutput, D as DeleteRoleInput, s as DeleteRoleOutput, U as UpdateRoleInput, u as UpdateRoleOutput } from '../shared/rbac.CocWK7y6.mjs';
3
+ import { L as LabeledScope$1, t as tables, C as CreateRoleInput, a as CreateRoleOutput, A as AssignRoleToUserInput, b as AssignRoleToUserOutput, c as AssignRolesToUserInput, d as AssignRolesToUserOutput, R as RevokeRoleFromUserInput, e as RevokeRoleFromUserOutput, G as GrantScopeToUserInput, f as GrantScopeToUserOutput, g as GrantScopesToUserInput, h as GrantScopesToUserOutput, i as RevokeScopeFromUserInput, j as RevokeScopeFromUserOutput, k as GrantScopeToRoleInput, l as GrantScopeToRoleOutput, m as RevokeScopeFromRoleInput, n as RevokeScopeFromRoleOutput, o as GetPermissionsOutput, p as GetUserPermissionsInput, q as GetUserPermissionsOutput, V as VerifyAccessInput, r as VerifyAccessOutput, D as DeleteRoleInput, s as DeleteRoleOutput, U as UpdateRoleInput, u as UpdateRoleOutput } from '../shared/rbac.DbnJpvqK.mjs';
4
4
  import { WorkerEntrypoint } from 'cloudflare:workers';
5
5
  import { DrizzleD1Database } from 'drizzle-orm/d1';
6
6
  import 'zod';
@@ -9,7 +9,7 @@ import '../shared/rbac.CqpxM3E5.mjs';
9
9
  import 'drizzle-orm/sqlite-core';
10
10
 
11
11
  declare const RbacServiceBase_base: (abstract new (ctx: ExecutionContext, env: RbacEnv) => WorkerEntrypoint<RbacEnv, {}>) & (abstract new (...args: any[]) => _develit_io_backend_sdk.DevelitWorkerMethods);
12
- declare class RbacServiceBase<TScopes extends readonly LabeledScope[] = LabeledScope[]> extends RbacServiceBase_base {
12
+ declare class RbacServiceBase<TScopes extends readonly LabeledScope$1[] = LabeledScope$1[]> extends RbacServiceBase_base {
13
13
  readonly db: DrizzleD1Database<typeof tables>;
14
14
  readonly SCOPES: TScopes;
15
15
  constructor(ctx: ExecutionContext, env: RbacEnv, scopes: TScopes);
@@ -26,19 +26,26 @@ declare class RbacServiceBase<TScopes extends readonly LabeledScope[] = LabeledS
26
26
  getPermissions(): Promise<IRPCResponse<GetPermissionsOutput>>;
27
27
  getUserPermissions(input: GetUserPermissionsInput): Promise<IRPCResponse<GetUserPermissionsOutput>>;
28
28
  verifyAccess(input: Omit<VerifyAccessInput, 'accessRequests'> & {
29
- accessRequests: Array<{
29
+ accessRequests: Array<Array<{
30
30
  scope: TScopes[number]['value'];
31
31
  resourceId?: string;
32
32
  resourcePath?: string;
33
- }>;
33
+ }>>;
34
34
  }): Promise<IRPCResponse<VerifyAccessOutput>>;
35
35
  deleteRole(input: DeleteRoleInput): Promise<IRPCResponse<DeleteRoleOutput>>;
36
36
  updateRole(input: UpdateRoleInput): Promise<IRPCResponse<UpdateRoleOutput>>;
37
37
  }
38
- declare function defineRbacService<const TScopes extends readonly LabeledScope[]>(config?: {
38
+ declare function defineRbacService<const TScopes extends readonly LabeledScope$1[]>(config?: {
39
39
  scopes: TScopes;
40
40
  }): new (ctx: ExecutionContext, env: RbacEnv) => RbacServiceBase<TScopes>;
41
41
 
42
+ declare const SCOPES: readonly ["tickets.read", "tickets.create", "tickets.edit", "tickets.delete", "tickets.archive", "tickets.automations.pause", "tickets.automations.resume", "tickets.dependencies.read", "tickets.dependencies.create", "tickets.dependencies.edit", "tickets.dependencies.delete", "tickets.confirmation.send", "tickets.confirmation.download", "tickets.payments.create", "tickets.payments.read", "tickets.payments.edit", "tickets.payments.delete", "tickets.payments.confirmation.send", "tickets.payments.confirmation.download", "tickets.logs.read", "tickets.logs.create", "tickets.logs.delete", "tickets.{jwt.user.rawUserMetaData.organizationId}.read", "tickets.{jwt.user.rawUserMetaData.organizationId}.create", "tickets.{jwt.user.rawUserMetaData.organizationId}.edit", "tickets.{jwt.user.rawUserMetaData.organizationId}.delete", "tickets.{jwt.user.rawUserMetaData.organizationId}.archive", "tickets.{jwt.user.rawUserMetaData.organizationId}.automations.pause", "tickets.{jwt.user.rawUserMetaData.organizationId}.automations.resume", "tickets.{jwt.user.rawUserMetaData.organizationId}.dependencies.read", "tickets.{jwt.user.rawUserMetaData.organizationId}.dependencies.create", "tickets.{jwt.user.rawUserMetaData.organizationId}.dependencies.edit", "tickets.{jwt.user.rawUserMetaData.organizationId}.dependencies.delete", "tickets.{jwt.user.rawUserMetaData.organizationId}.confirmation.send", "tickets.{jwt.user.rawUserMetaData.organizationId}.confirmation.download", "tickets.{jwt.user.rawUserMetaData.organizationId}.payments.create", "tickets.{jwt.user.rawUserMetaData.organizationId}.payments.read", "tickets.{jwt.user.rawUserMetaData.organizationId}.payments.edit", "tickets.{jwt.user.rawUserMetaData.organizationId}.payments.delete", "tickets.{jwt.user.rawUserMetaData.organizationId}.payments.confirmation.send", "tickets.{jwt.user.rawUserMetaData.organizationId}.payments.confirmation.download", "tickets.{jwt.user.rawUserMetaData.organizationId}.logs.read", "tickets.{jwt.user.rawUserMetaData.organizationId}.logs.create", "tickets.{jwt.user.rawUserMetaData.organizationId}.logs.delete", "clients.read", "clients.create", "clients.edit", "clients.delete", "clients.pin.read", "clients.pin.edit", "clients.trader.edit", "clients.logs.read", "clients.logs.create", "clients.logs.delete", "clients.{jwt.user.rawUserMetaData.organizationId}.read", "clients.{jwt.user.rawUserMetaData.organizationId}.create", "clients.{jwt.user.rawUserMetaData.organizationId}.edit", "clients.{jwt.user.rawUserMetaData.organizationId}.delete", "clients.{jwt.user.rawUserMetaData.organizationId}.pin.read", "clients.{jwt.user.rawUserMetaData.organizationId}.pin.edit", "clients.{jwt.user.rawUserMetaData.organizationId}.trader.edit", "clients.{jwt.user.rawUserMetaData.organizationId}.logs.read", "clients.{jwt.user.rawUserMetaData.organizationId}.logs.create", "clients.{jwt.user.rawUserMetaData.organizationId}.logs.delete", "users.read", "users.create", "users.edit", "users.delete", "users.ban", "users.password.reset.send", "users.password.edit", "users.2fa.enable", "users.2fa.disable", "users.roles.read", "users.roles.edit", "users.scopes.read", "users.scopes.assign", "users.scopes.delete", "users.logs.read", "users.logs.create", "users.logs.delete", "users.{jwt.user.rawUserMetaData.organizationId}.read", "users.{jwt.user.rawUserMetaData.organizationId}.create", "users.{jwt.user.rawUserMetaData.organizationId}.edit", "users.{jwt.user.rawUserMetaData.organizationId}.delete", "users.{jwt.user.rawUserMetaData.organizationId}.ban", "users.{jwt.user.rawUserMetaData.organizationId}.password.reset.send", "users.{jwt.user.rawUserMetaData.organizationId}.password.edit", "users.{jwt.user.rawUserMetaData.organizationId}.2fa.enable", "users.{jwt.user.rawUserMetaData.organizationId}.2fa.disable", "users.{jwt.user.rawUserMetaData.organizationId}.roles.read", "users.{jwt.user.rawUserMetaData.organizationId}.roles.edit", "users.{jwt.user.rawUserMetaData.organizationId}.scopes.read", "users.{jwt.user.rawUserMetaData.organizationId}.scopes.assign", "users.{jwt.user.rawUserMetaData.organizationId}.scopes.delete", "users.{jwt.user.rawUserMetaData.organizationId}.logs.read", "users.{jwt.user.rawUserMetaData.organizationId}.logs.create", "users.{jwt.user.rawUserMetaData.organizationId}.logs.delete", "traders.read", "traders.create", "traders.edit", "traders.delete", "traders.logs", "roles.read", "roles.create", "roles.edit", "roles.delete", "roles.scopes.assign", "roles.scopes.delete", "roles.logs.read", "roles.logs.create", "roles.logs.delete", "roles.users.read", "test.read", "test.edit", "test.delete", "test.{jwt.organizationId}.read", "test.{jwt.user.rawUserMetaData.organizationId}.read", "test.{jwt.user.rawUserMetaData.organizationId}.edit", "test.{param.resourceId}.read", "test.organization.{jwt.user.rawUserMetaData.organizationId}.resource.{jwt.user.rawUserMetaData.organizationId}.read", "test.organization.{jwt.user.rawUserMetaData.organizationId}.branch.{jwt.userData.organizationBranchId}.read", "test.{invalid}.scope", "test.{}.scope", "test.{jwt.}.scope", "test.{.key}.scope"];
43
+ type LabeledScope = {
44
+ label: string;
45
+ value: (typeof SCOPES)[number];
46
+ };
47
+ declare const LABELED_SCOPES: LabeledScope[];
48
+
42
49
  declare const _default: new (ctx: ExecutionContext, env: RbacEnv) => WorkerEntrypoint<RbacEnv>;
43
50
 
44
- export { _default as default, defineRbacService };
51
+ export { LABELED_SCOPES, _default as default, defineRbacService };
package/dist/export/worker.d.ts CHANGED
@@ -1,6 +1,6 @@
1
1
  import * as _develit_io_backend_sdk from '@develit-io/backend-sdk';
2
2
  import { IRPCResponse } from '@develit-io/backend-sdk';
3
- import { L as LabeledScope, t as tables, C as CreateRoleInput, a as CreateRoleOutput, A as AssignRoleToUserInput, b as AssignRoleToUserOutput, c as AssignRolesToUserInput, d as AssignRolesToUserOutput, R as RevokeRoleFromUserInput, e as RevokeRoleFromUserOutput, G as GrantScopeToUserInput, f as GrantScopeToUserOutput, g as GrantScopesToUserInput, h as GrantScopesToUserOutput, i as RevokeScopeFromUserInput, j as RevokeScopeFromUserOutput, k as GrantScopeToRoleInput, l as GrantScopeToRoleOutput, m as RevokeScopeFromRoleInput, n as RevokeScopeFromRoleOutput, o as GetPermissionsOutput, p as GetUserPermissionsInput, q as GetUserPermissionsOutput, V as VerifyAccessInput, r as VerifyAccessOutput, D as DeleteRoleInput, s as DeleteRoleOutput, U as UpdateRoleInput, u as UpdateRoleOutput } from '../shared/rbac.CAcqvrNj.js';
3
+ import { L as LabeledScope$1, t as tables, C as CreateRoleInput, a as CreateRoleOutput, A as AssignRoleToUserInput, b as AssignRoleToUserOutput, c as AssignRolesToUserInput, d as AssignRolesToUserOutput, R as RevokeRoleFromUserInput, e as RevokeRoleFromUserOutput, G as GrantScopeToUserInput, f as GrantScopeToUserOutput, g as GrantScopesToUserInput, h as GrantScopesToUserOutput, i as RevokeScopeFromUserInput, j as RevokeScopeFromUserOutput, k as GrantScopeToRoleInput, l as GrantScopeToRoleOutput, m as RevokeScopeFromRoleInput, n as RevokeScopeFromRoleOutput, o as GetPermissionsOutput, p as GetUserPermissionsInput, q as GetUserPermissionsOutput, V as VerifyAccessInput, r as VerifyAccessOutput, D as DeleteRoleInput, s as DeleteRoleOutput, U as UpdateRoleInput, u as UpdateRoleOutput } from '../shared/rbac.DrhiDe1P.js';
4
4
  import { WorkerEntrypoint } from 'cloudflare:workers';
5
5
  import { DrizzleD1Database } from 'drizzle-orm/d1';
6
6
  import 'zod';
@@ -9,7 +9,7 @@ import '../shared/rbac.CqpxM3E5.js';
9
9
  import 'drizzle-orm/sqlite-core';
10
10
 
11
11
  declare const RbacServiceBase_base: (abstract new (ctx: ExecutionContext, env: RbacEnv) => WorkerEntrypoint<RbacEnv, {}>) & (abstract new (...args: any[]) => _develit_io_backend_sdk.DevelitWorkerMethods);
12
- declare class RbacServiceBase<TScopes extends readonly LabeledScope[] = LabeledScope[]> extends RbacServiceBase_base {
12
+ declare class RbacServiceBase<TScopes extends readonly LabeledScope$1[] = LabeledScope$1[]> extends RbacServiceBase_base {
13
13
  readonly db: DrizzleD1Database<typeof tables>;
14
14
  readonly SCOPES: TScopes;
15
15
  constructor(ctx: ExecutionContext, env: RbacEnv, scopes: TScopes);
@@ -26,21 +26,28 @@ declare class RbacServiceBase<TScopes extends readonly LabeledScope[] = LabeledS
26
26
  getPermissions(): Promise<IRPCResponse<GetPermissionsOutput>>;
27
27
  getUserPermissions(input: GetUserPermissionsInput): Promise<IRPCResponse<GetUserPermissionsOutput>>;
28
28
  verifyAccess(input: Omit<VerifyAccessInput, 'accessRequests'> & {
29
- accessRequests: Array<{
29
+ accessRequests: Array<Array<{
30
30
  scope: TScopes[number]['value'];
31
31
  resourceId?: string;
32
32
  resourcePath?: string;
33
- }>;
33
+ }>>;
34
34
  }): Promise<IRPCResponse<VerifyAccessOutput>>;
35
35
  deleteRole(input: DeleteRoleInput): Promise<IRPCResponse<DeleteRoleOutput>>;
36
36
  updateRole(input: UpdateRoleInput): Promise<IRPCResponse<UpdateRoleOutput>>;
37
37
  }
38
- declare function defineRbacService<const TScopes extends readonly LabeledScope[]>(config?: {
38
+ declare function defineRbacService<const TScopes extends readonly LabeledScope$1[]>(config?: {
39
39
  scopes: TScopes;
40
40
  }): new (ctx: ExecutionContext, env: RbacEnv) => RbacServiceBase<TScopes>;
41
41
 
42
+ declare const SCOPES: readonly ["tickets.read", "tickets.create", "tickets.edit", "tickets.delete", "tickets.archive", "tickets.automations.pause", "tickets.automations.resume", "tickets.dependencies.read", "tickets.dependencies.create", "tickets.dependencies.edit", "tickets.dependencies.delete", "tickets.confirmation.send", "tickets.confirmation.download", "tickets.payments.create", "tickets.payments.read", "tickets.payments.edit", "tickets.payments.delete", "tickets.payments.confirmation.send", "tickets.payments.confirmation.download", "tickets.logs.read", "tickets.logs.create", "tickets.logs.delete", "tickets.{jwt.user.rawUserMetaData.organizationId}.read", "tickets.{jwt.user.rawUserMetaData.organizationId}.create", "tickets.{jwt.user.rawUserMetaData.organizationId}.edit", "tickets.{jwt.user.rawUserMetaData.organizationId}.delete", "tickets.{jwt.user.rawUserMetaData.organizationId}.archive", "tickets.{jwt.user.rawUserMetaData.organizationId}.automations.pause", "tickets.{jwt.user.rawUserMetaData.organizationId}.automations.resume", "tickets.{jwt.user.rawUserMetaData.organizationId}.dependencies.read", "tickets.{jwt.user.rawUserMetaData.organizationId}.dependencies.create", "tickets.{jwt.user.rawUserMetaData.organizationId}.dependencies.edit", "tickets.{jwt.user.rawUserMetaData.organizationId}.dependencies.delete", "tickets.{jwt.user.rawUserMetaData.organizationId}.confirmation.send", "tickets.{jwt.user.rawUserMetaData.organizationId}.confirmation.download", "tickets.{jwt.user.rawUserMetaData.organizationId}.payments.create", "tickets.{jwt.user.rawUserMetaData.organizationId}.payments.read", "tickets.{jwt.user.rawUserMetaData.organizationId}.payments.edit", "tickets.{jwt.user.rawUserMetaData.organizationId}.payments.delete", "tickets.{jwt.user.rawUserMetaData.organizationId}.payments.confirmation.send", "tickets.{jwt.user.rawUserMetaData.organizationId}.payments.confirmation.download", "tickets.{jwt.user.rawUserMetaData.organizationId}.logs.read", "tickets.{jwt.user.rawUserMetaData.organizationId}.logs.create", "tickets.{jwt.user.rawUserMetaData.organizationId}.logs.delete", "clients.read", "clients.create", "clients.edit", "clients.delete", "clients.pin.read", "clients.pin.edit", "clients.trader.edit", "clients.logs.read", "clients.logs.create", "clients.logs.delete", "clients.{jwt.user.rawUserMetaData.organizationId}.read", "clients.{jwt.user.rawUserMetaData.organizationId}.create", "clients.{jwt.user.rawUserMetaData.organizationId}.edit", "clients.{jwt.user.rawUserMetaData.organizationId}.delete", "clients.{jwt.user.rawUserMetaData.organizationId}.pin.read", "clients.{jwt.user.rawUserMetaData.organizationId}.pin.edit", "clients.{jwt.user.rawUserMetaData.organizationId}.trader.edit", "clients.{jwt.user.rawUserMetaData.organizationId}.logs.read", "clients.{jwt.user.rawUserMetaData.organizationId}.logs.create", "clients.{jwt.user.rawUserMetaData.organizationId}.logs.delete", "users.read", "users.create", "users.edit", "users.delete", "users.ban", "users.password.reset.send", "users.password.edit", "users.2fa.enable", "users.2fa.disable", "users.roles.read", "users.roles.edit", "users.scopes.read", "users.scopes.assign", "users.scopes.delete", "users.logs.read", "users.logs.create", "users.logs.delete", "users.{jwt.user.rawUserMetaData.organizationId}.read", "users.{jwt.user.rawUserMetaData.organizationId}.create", "users.{jwt.user.rawUserMetaData.organizationId}.edit", "users.{jwt.user.rawUserMetaData.organizationId}.delete", "users.{jwt.user.rawUserMetaData.organizationId}.ban", "users.{jwt.user.rawUserMetaData.organizationId}.password.reset.send", "users.{jwt.user.rawUserMetaData.organizationId}.password.edit", "users.{jwt.user.rawUserMetaData.organizationId}.2fa.enable", "users.{jwt.user.rawUserMetaData.organizationId}.2fa.disable", "users.{jwt.user.rawUserMetaData.organizationId}.roles.read", "users.{jwt.user.rawUserMetaData.organizationId}.roles.edit", "users.{jwt.user.rawUserMetaData.organizationId}.scopes.read", "users.{jwt.user.rawUserMetaData.organizationId}.scopes.assign", "users.{jwt.user.rawUserMetaData.organizationId}.scopes.delete", "users.{jwt.user.rawUserMetaData.organizationId}.logs.read", "users.{jwt.user.rawUserMetaData.organizationId}.logs.create", "users.{jwt.user.rawUserMetaData.organizationId}.logs.delete", "traders.read", "traders.create", "traders.edit", "traders.delete", "traders.logs", "roles.read", "roles.create", "roles.edit", "roles.delete", "roles.scopes.assign", "roles.scopes.delete", "roles.logs.read", "roles.logs.create", "roles.logs.delete", "roles.users.read", "test.read", "test.edit", "test.delete", "test.{jwt.organizationId}.read", "test.{jwt.user.rawUserMetaData.organizationId}.read", "test.{jwt.user.rawUserMetaData.organizationId}.edit", "test.{param.resourceId}.read", "test.organization.{jwt.user.rawUserMetaData.organizationId}.resource.{jwt.user.rawUserMetaData.organizationId}.read", "test.organization.{jwt.user.rawUserMetaData.organizationId}.branch.{jwt.userData.organizationBranchId}.read", "test.{invalid}.scope", "test.{}.scope", "test.{jwt.}.scope", "test.{.key}.scope"];
43
+ type LabeledScope = {
44
+ label: string;
45
+ value: (typeof SCOPES)[number];
46
+ };
47
+ declare const LABELED_SCOPES: LabeledScope[];
48
+
42
49
  declare const _default: new (ctx: ExecutionContext, env: RbacEnv) => WorkerEntrypoint<RbacEnv>;
43
50
 
44
51
  // @ts-ignore
45
52
  export = _default;
46
- export { defineRbacService };
53
+ export { LABELED_SCOPES, defineRbacService };
package/dist/export/worker.mjs CHANGED
@@ -1,7 +1,7 @@
1
1
  import { uuidv4, first, createInternalError, develitWorker, action, service } from '@develit-io/backend-sdk';
2
2
  import { s as schema } from '../shared/rbac.D5OV7UPA.mjs';
3
3
  import { eq, and, count, inArray } from 'drizzle-orm';
4
- import { c as createRoleInputSchema, a as assignRoleToUserInputSchema, b as assignRolesToUserInputSchema, r as revokeRoleFromUserInputSchema, f as grantScopeToUserInputSchema, h as grantScopesToUserInputSchema, j as revokeScopeFromUserInputSchema, e as grantScopeToRoleInputSchema, i as revokeScopeFromRoleInputSchema, g as getUserPermissionsInputSchema, v as verifyAccessInputSchema, d as deleteRoleInputSchema, u as updateRoleInputSchema } from '../shared/rbac.CUCczegz.mjs';
4
+ import { c as createRoleInputSchema, a as assignRoleToUserInputSchema, b as assignRolesToUserInputSchema, r as revokeRoleFromUserInputSchema, f as grantScopeToUserInputSchema, h as grantScopesToUserInputSchema, j as revokeScopeFromUserInputSchema, e as grantScopeToRoleInputSchema, i as revokeScopeFromRoleInputSchema, g as getUserPermissionsInputSchema, v as verifyAccessInputSchema, d as deleteRoleInputSchema, u as updateRoleInputSchema } from '../shared/rbac.ihzxYB9Z.mjs';
5
5
  import { z } from 'zod';
6
6
  import { WorkerEntrypoint } from 'cloudflare:workers';
7
7
  import { drizzle } from 'drizzle-orm/d1';
@@ -654,12 +654,13 @@ let RbacServiceBase = class extends develitWorker(WorkerEntrypoint) {
654
654
  }
655
655
  async verifyAccess(input) {
656
656
  return this.handleAction(
657
- // TODO: This input schema is just copied from auth and is not 100% type safe
658
657
  { data: input, schema: verifyAccessInputSchema },
659
658
  { successMessage: "Access verification completed." },
660
659
  async ({ userId, accessRequests, jwt }) => {
661
- for (const request of accessRequests) {
662
- this.validateScope(request.scope);
660
+ for (const requestGroup of accessRequests) {
661
+ for (const request of requestGroup) {
662
+ this.validateScope(request.scope);
663
+ }
663
664
  }
664
665
  const userPermissionsResponse = await this.getUserPermissions({
665
666
  userId
@@ -674,46 +675,55 @@ let RbacServiceBase = class extends develitWorker(WorkerEntrypoint) {
674
675
  ...userPermissionsResponse.data.roleScopes,
675
676
  ...userPermissionsResponse.data.scopes
676
677
  ];
677
- const allAccessRequestsSatisfied = accessRequests.every((request) => {
678
- const placeholders = parseScopeTemplate(request.scope);
679
- return allScopes.some((userScope) => {
680
- const scopesMatch = userScope.scope === request.scope;
681
- let resourceMatches = false;
682
- if (placeholders.length > 0) {
683
- if (!request.resourcePath) {
684
- throw createInternalError(null, {
685
- message: `Resource path is required when scope '${request.scope}' contains placeholders`,
686
- status: 400,
687
- code: "RESOURCE_PATH_REQUIRED"
688
- });
689
- }
690
- const extractedResources = extractResourcesFromPath(
691
- request.scope,
692
- request.resourcePath
693
- );
694
- const allPlaceholdersMatch = placeholders.every((placeholder) => {
695
- const extractedValue = extractedResources[`${placeholder.type}.${placeholder.path}`];
696
- const jwtParam = placeholder.type === "jwt" ? jwt : void 0;
697
- const expectedValue = getValueByKey(
698
- placeholder.type,
699
- placeholder.path,
700
- jwtParam
701
- );
702
- if (expectedValue === void 0) {
703
- return false;
678
+ if (accessRequests.length === 0) {
679
+ return {
680
+ isVerified: true
681
+ };
682
+ }
683
+ const anyGroupSatisfied = accessRequests.some((requestGroup) => {
684
+ return requestGroup.every((request) => {
685
+ const placeholders = parseScopeTemplate(request.scope);
686
+ return allScopes.some((userScope) => {
687
+ const scopesMatch = userScope.scope === request.scope;
688
+ let resourceMatches = false;
689
+ if (placeholders.length > 0) {
690
+ if (!request.resourcePath) {
691
+ throw createInternalError(null, {
692
+ message: `Resource path is required when scope '${request.scope}' contains placeholders`,
693
+ status: 400,
694
+ code: "RESOURCE_PATH_REQUIRED"
695
+ });
704
696
  }
705
- return String(extractedValue) === String(expectedValue);
706
- });
707
- const resourceIdMatches = userScope.resourceId === null || userScope.resourceId === request.resourceId;
708
- resourceMatches = allPlaceholdersMatch && resourceIdMatches;
709
- } else {
710
- resourceMatches = userScope.resourceId === null || userScope.resourceId === request.resourceId;
711
- }
712
- return scopesMatch && resourceMatches;
697
+ const extractedResources = extractResourcesFromPath(
698
+ request.scope,
699
+ request.resourcePath
700
+ );
701
+ const allPlaceholdersMatch = placeholders.every(
702
+ (placeholder) => {
703
+ const extractedValue = extractedResources[`${placeholder.type}.${placeholder.path}`];
704
+ const jwtParam = placeholder.type === "jwt" ? jwt : void 0;
705
+ const expectedValue = getValueByKey(
706
+ placeholder.type,
707
+ placeholder.path,
708
+ jwtParam
709
+ );
710
+ if (expectedValue === void 0) {
711
+ return false;
712
+ }
713
+ return String(extractedValue) === String(expectedValue);
714
+ }
715
+ );
716
+ const resourceIdMatches = userScope.resourceId === null || userScope.resourceId === request.resourceId;
717
+ resourceMatches = allPlaceholdersMatch && resourceIdMatches;
718
+ } else {
719
+ resourceMatches = userScope.resourceId === null || userScope.resourceId === request.resourceId;
720
+ }
721
+ return scopesMatch && resourceMatches;
722
+ });
713
723
  });
714
724
  });
715
725
  return {
716
- isVerified: allAccessRequestsSatisfied
726
+ isVerified: anyGroupSatisfied
717
727
  };
718
728
  }
719
729
  );
@@ -794,6 +804,266 @@ function defineRbacService(config = { scopes: [] }) {
794
804
  };
795
805
  }
796
806
 
797
- const RbacService = defineRbacService();
807
+ const organizationScopedKeys = (scopes) => {
808
+ const out = scopes.map((scope) => {
809
+ const [prefix, ...rest] = scope.split(".");
810
+ return `${prefix}.{jwt.user.rawUserMetaData.organizationId}.${rest.join(".")}`;
811
+ });
812
+ return out;
813
+ };
814
+ const TEST_SCOPES = [
815
+ "test.read",
816
+ "test.edit",
817
+ "test.delete",
818
+ "test.{jwt.organizationId}.read",
819
+ "test.{jwt.user.rawUserMetaData.organizationId}.read",
820
+ "test.{jwt.user.rawUserMetaData.organizationId}.edit",
821
+ "test.{param.resourceId}.read",
822
+ "test.organization.{jwt.user.rawUserMetaData.organizationId}.resource.{jwt.user.rawUserMetaData.organizationId}.read",
823
+ "test.organization.{jwt.user.rawUserMetaData.organizationId}.branch.{jwt.userData.organizationBranchId}.read",
824
+ "test.{invalid}.scope",
825
+ "test.{}.scope",
826
+ "test.{jwt.}.scope",
827
+ "test.{.key}.scope"
828
+ ];
829
+ const TICKET_SCOPES = [
830
+ "tickets.read",
831
+ "tickets.create",
832
+ "tickets.edit",
833
+ "tickets.delete",
834
+ "tickets.archive",
835
+ "tickets.automations.pause",
836
+ "tickets.automations.resume",
837
+ "tickets.dependencies.read",
838
+ "tickets.dependencies.create",
839
+ "tickets.dependencies.edit",
840
+ "tickets.dependencies.delete",
841
+ "tickets.confirmation.send",
842
+ "tickets.confirmation.download",
843
+ "tickets.payments.create",
844
+ "tickets.payments.read",
845
+ "tickets.payments.edit",
846
+ "tickets.payments.delete",
847
+ "tickets.payments.confirmation.send",
848
+ "tickets.payments.confirmation.download",
849
+ "tickets.logs.read",
850
+ "tickets.logs.create",
851
+ "tickets.logs.delete"
852
+ ];
853
+ const CLIENT_SCOPES = [
854
+ "clients.read",
855
+ "clients.create",
856
+ "clients.edit",
857
+ "clients.delete",
858
+ "clients.pin.read",
859
+ // if not - gw returns **** for pin
860
+ "clients.pin.edit",
861
+ // if not - fe should not allow pin change
862
+ "clients.trader.edit",
863
+ "clients.logs.read",
864
+ "clients.logs.create",
865
+ "clients.logs.delete"
866
+ ];
867
+ const USER_SCOPES = [
868
+ "users.read",
869
+ "users.create",
870
+ "users.edit",
871
+ "users.delete",
872
+ "users.ban",
873
+ "users.password.reset.send",
874
+ "users.password.edit",
875
+ "users.2fa.enable",
876
+ "users.2fa.disable",
877
+ "users.roles.read",
878
+ "users.roles.edit",
879
+ "users.scopes.read",
880
+ "users.scopes.assign",
881
+ "users.scopes.delete",
882
+ "users.logs.read",
883
+ "users.logs.create",
884
+ "users.logs.delete"
885
+ ];
886
+ [
887
+ // Ticket scopes
888
+ ...TICKET_SCOPES,
889
+ ...organizationScopedKeys(TICKET_SCOPES),
890
+ // Client scopes
891
+ ...CLIENT_SCOPES,
892
+ ...organizationScopedKeys(CLIENT_SCOPES),
893
+ // User scopes
894
+ ...USER_SCOPES,
895
+ ...organizationScopedKeys(USER_SCOPES),
896
+ // Trader scopes
897
+ "traders.read",
898
+ "traders.create",
899
+ "traders.edit",
900
+ "traders.delete",
901
+ "traders.logs",
902
+ // Role scopes
903
+ "roles.read",
904
+ "roles.create",
905
+ "roles.edit",
906
+ "roles.delete",
907
+ "roles.scopes.assign",
908
+ // assign scopes to roles
909
+ "roles.scopes.delete",
910
+ // delete scopes from roles
911
+ "roles.logs.read",
912
+ "roles.logs.create",
913
+ "roles.logs.delete",
914
+ "roles.users.read",
915
+ // read users assigned to roles
916
+ // Ledger scopes
917
+ // 'accounts.read',
918
+ // 'accounts.create',
919
+ // 'accounts.edit',
920
+ // 'accounts.delete',
921
+ // 'accounts.archive',
922
+ // 'accounts.balance',
923
+ // 'accounts.identifiers.create',
924
+ // 'accounts.identifiers.read',
925
+ // 'accounts.identifiers.edit',
926
+ // 'accounts.identifiers.delete',
927
+ // 'accounts.transactions.read',
928
+ // 'accounts.logs.read',
929
+ // 'accounts.logs.create',
930
+ // 'accounts.logs.delete',
931
+ ...TEST_SCOPES
932
+ ];
933
+ const LABELED_SCOPES = [
934
+ { label: "Zobrazit tikety", value: "tickets.read" },
935
+ {
936
+ label: "Zobrazit tikety v r\xE1mci organizace",
937
+ value: "tickets.{jwt.user.rawUserMetaData.organizationId}.read"
938
+ },
939
+ { label: "Vytvo\u0159it tiket", value: "tickets.create" },
940
+ { label: "Upravit tiket", value: "tickets.edit" },
941
+ { label: "Smazat tiket", value: "tickets.delete" },
942
+ { label: "Archivovat tiket", value: "tickets.archive" },
943
+ {
944
+ label: "Pozastavit automatizaci tiketu",
945
+ value: "tickets.automations.pause"
946
+ },
947
+ { label: "Obnovit automatizaci tiketu", value: "tickets.automations.resume" },
948
+ { label: "Zobrazit z\xE1vislosti tiket\u016F", value: "tickets.dependencies.read" },
949
+ { label: "Vytvo\u0159it z\xE1vislosti tiket\u016F", value: "tickets.dependencies.create" },
950
+ { label: "Upravit z\xE1vislosti tiket\u016F", value: "tickets.dependencies.edit" },
951
+ { label: "Smazat z\xE1vislosti tiket\u016F", value: "tickets.dependencies.delete" },
952
+ { label: "Poslat potvrzen\xED tiketu", value: "tickets.confirmation.send" },
953
+ {
954
+ label: "St\xE1hnout potvrzen\xED tiketu",
955
+ value: "tickets.confirmation.download"
956
+ },
957
+ { label: "Vytvo\u0159it platbu tiketu", value: "tickets.payments.create" },
958
+ { label: "Zobrazit platby tiketu", value: "tickets.payments.read" },
959
+ { label: "Upravit platby tiketu", value: "tickets.payments.edit" },
960
+ { label: "Smazat platby tiketu", value: "tickets.payments.delete" },
961
+ {
962
+ label: "Poslat potvrzen\xED platby tiketu",
963
+ value: "tickets.payments.confirmation.send"
964
+ },
965
+ {
966
+ label: "St\xE1hnout potvrzen\xED platby tiketu",
967
+ value: "tickets.payments.confirmation.download"
968
+ },
969
+ { label: "Zobrazit logy tiketu", value: "tickets.logs.read" },
970
+ { label: "Vytvo\u0159it logy tiketu", value: "tickets.logs.create" },
971
+ { label: "Smazat logy tiketu", value: "tickets.logs.delete" },
972
+ { label: "Zobrazit obchodn\xEDky", value: "traders.read" },
973
+ { label: "Vytvo\u0159it obchodn\xEDky", value: "traders.create" },
974
+ { label: "Upravit obchodn\xEDky", value: "traders.edit" },
975
+ { label: "Smazat obchodn\xEDky", value: "traders.delete" },
976
+ { label: "Logy obchodn\xEDk\u016F", value: "traders.logs" },
977
+ { label: "Zobrazit klienty", value: "clients.read" },
978
+ { label: "Vytvo\u0159it klienty", value: "clients.create" },
979
+ { label: "Upravit klienty", value: "clients.edit" },
980
+ { label: "Smazat klienty", value: "clients.delete" },
981
+ { label: "Zobrazit PIN klienta", value: "clients.pin.read" },
982
+ { label: "Upravit PIN klienta", value: "clients.pin.edit" },
983
+ // { label: 'Zobrazit limity klienta', value: 'clients.limits.read' },
984
+ // { label: 'Upravit limity klienta', value: 'clients.limits.edit' },
985
+ // { label: 'Přiřadit obchodníka klientovi', value: 'clients.trader.assign' },
986
+ { label: "Upravit obchodn\xEDka klienta", value: "clients.trader.edit" },
987
+ { label: "Zobrazit logy klient\u016F", value: "clients.logs.read" },
988
+ { label: "Vytvo\u0159it logy klient\u016F", value: "clients.logs.create" },
989
+ { label: "Smazat logy klient\u016F", value: "clients.logs.delete" },
990
+ { label: "Zobrazit u\u017Eivatele", value: "users.read" },
991
+ { label: "Vytvo\u0159it u\u017Eivatele", value: "users.create" },
992
+ { label: "Upravit u\u017Eivatele", value: "users.edit" },
993
+ { label: "Smazat u\u017Eivatele", value: "users.delete" },
994
+ // { label: 'Archivovat uživatele', value: 'users.archive' },
995
+ { label: "Poslat reset hesla", value: "users.password.reset.send" },
996
+ // { label: 'Zobrazit oprávnění uživatelů', value: 'users.permissions.read' },
997
+ // { label: 'Přiřadit oprávnění uživatelům', value: 'users.permissions.assign' },
998
+ // { label: 'Odebrat oprávnění uživatelům', value: 'users.permissions.delete' },
999
+ { label: "Povolit 2FA u\u017Eivatel\u016Fm", value: "users.2fa.enable" },
1000
+ { label: "Zak\xE1zat 2FA u\u017Eivatel\u016Fm", value: "users.2fa.disable" },
1001
+ { label: "Zobrazit logy u\u017Eivatel\u016F", value: "users.logs.read" },
1002
+ { label: "Vytvo\u0159it logy u\u017Eivatel\u016F", value: "users.logs.create" },
1003
+ { label: "Smazat logy u\u017Eivatel\u016F", value: "users.logs.delete" },
1004
+ { label: "Zobrazit role", value: "roles.read" },
1005
+ { label: "Vytvo\u0159it role", value: "roles.create" },
1006
+ { label: "Upravit role", value: "roles.edit" },
1007
+ { label: "Smazat role", value: "roles.delete" },
1008
+ // { label: 'Přiřadit oprávnění rolím', value: 'roles.permissions.assign' },
1009
+ // { label: 'Odebrat oprávnění rolím', value: 'roles.permissions.delete' },
1010
+ { label: "Zobrazit logy rol\xED", value: "roles.logs.read" },
1011
+ { label: "Vytvo\u0159it logy rol\xED", value: "roles.logs.create" },
1012
+ { label: "Smazat logy rol\xED", value: "roles.logs.delete" },
1013
+ { label: "Zobrazit u\u017Eivatele p\u0159i\u0159azen\xE9 k rol\xEDm", value: "roles.users.read" },
1014
+ // Test scopes
1015
+ { label: "Test: Read", value: "test.read" },
1016
+ { label: "Test: Edit", value: "test.edit" },
1017
+ { label: "Test: Delete", value: "test.delete" },
1018
+ {
1019
+ label: "Test: Organization ID Read (JWT - invalid path)",
1020
+ value: "test.{jwt.organizationId}.read"
1021
+ },
1022
+ {
1023
+ label: "Test: Organization Read (JWT)",
1024
+ value: "test.{jwt.user.rawUserMetaData.organizationId}.read"
1025
+ },
1026
+ {
1027
+ label: "Test: Organization Edit (JWT)",
1028
+ value: "test.{jwt.user.rawUserMetaData.organizationId}.edit"
1029
+ },
1030
+ {
1031
+ label: "Test: Resource Read (Param)",
1032
+ value: "test.{param.resourceId}.read"
1033
+ },
1034
+ {
1035
+ label: "Test: Organization Resource Read (Multiple JWT placeholders)",
1036
+ value: "test.organization.{jwt.user.rawUserMetaData.organizationId}.resource.{jwt.user.rawUserMetaData.organizationId}.read"
1037
+ },
1038
+ {
1039
+ label: "Test: Organization Branch Read (JWT userData)",
1040
+ value: "test.organization.{jwt.user.rawUserMetaData.organizationId}.branch.{jwt.userData.organizationBranchId}.read"
1041
+ },
1042
+ { label: "Test: Invalid placeholder format", value: "test.{invalid}.scope" },
1043
+ { label: "Test: Empty placeholder", value: "test.{}.scope" },
1044
+ { label: "Test: Empty key placeholder", value: "test.{jwt.}.scope" },
1045
+ { label: "Test: Empty type placeholder", value: "test.{.key}.scope" }
1046
+ // { label: 'Zobrazit účty', value: 'accounts.read' },
1047
+ // { label: 'Vytvořit účty', value: 'accounts.create' },
1048
+ // { label: 'Upravit účty', value: 'accounts.edit' },
1049
+ // { label: 'Smazat účty', value: 'accounts.delete' },
1050
+ // { label: 'Archivovat účty', value: 'accounts.archive' },
1051
+ // { label: 'Zobrazit zůstatek účtu', value: 'accounts.balance' },
1052
+ // {
1053
+ // label: 'Vytvořit identifikátory účtu',
1054
+ // value: 'accounts.identifiers.create',
1055
+ // },
1056
+ // { label: 'Zobrazit identifikátory účtu', value: 'accounts.identifiers.read' },
1057
+ // { label: 'Upravit identifikátory účtu', value: 'accounts.identifiers.edit' },
1058
+ // { label: 'Smazat identifikátory účtu', value: 'accounts.identifiers.delete' },
1059
+ // { label: 'Zobrazit transakce účtu', value: 'accounts.transactions.read' },
1060
+ // { label: 'Zobrazit logy účtů', value: 'accounts.logs.read' },
1061
+ // { label: 'Vytvořit logy účtů', value: 'accounts.logs.create' },
1062
+ // { label: 'Smazat logy účtů', value: 'accounts.logs.delete' },
1063
+ ];
1064
+
1065
+ const RbacService = defineRbacService({
1066
+ scopes: LABELED_SCOPES
1067
+ });
798
1068
 
799
- export { RbacService as default, defineRbacService };
1069
+ export { LABELED_SCOPES, RbacService as default, defineRbacService };
package/dist/shared/{rbac.DB0xguAY.d.cts → rbac.B4wUvd3l.d.cts} RENAMED
@@ -190,11 +190,11 @@ interface UpdateRoleOutput {
190
190
 
191
191
  declare const verifyAccessInputSchema: z.ZodObject<{
192
192
  userId: z.ZodUUID;
193
- accessRequests: z.ZodArray<z.ZodObject<{
193
+ accessRequests: z.ZodArray<z.ZodArray<z.ZodObject<{
194
194
  scope: z.ZodString;
195
195
  resourceId: z.ZodOptional<z.ZodString>;
196
196
  resourcePath: z.ZodOptional<z.ZodString>;
197
- }, z.core.$strip>>;
197
+ }, z.core.$strip>>>;
198
198
  jwt: z.ZodOptional<z.ZodObject<{
199
199
  sub: z.ZodString;
200
200
  iat: z.ZodNumber;
package/dist/shared/{rbac.B2KUW5xp.cjs → rbac.BZDCYlSt.cjs} RENAMED
@@ -140,11 +140,13 @@ const coercedJwtPayloadSchema = jwtPayloadSchema.extend({
140
140
  const verifyAccessInputSchema = zod.z.object({
141
141
  userId: zod.z.uuid(),
142
142
  accessRequests: zod.z.array(
143
- zod.z.object({
144
- scope: zod.z.string(),
145
- resourceId: zod.z.string().optional(),
146
- resourcePath: zod.z.string().optional()
147
- })
143
+ zod.z.array(
144
+ zod.z.object({
145
+ scope: zod.z.string(),
146
+ resourceId: zod.z.string().optional(),
147
+ resourcePath: zod.z.string().optional()
148
+ })
149
+ )
148
150
  ),
149
151
  jwt: coercedJwtPayloadSchema.optional()
150
152
  });
package/dist/shared/{rbac.CocWK7y6.d.mts → rbac.DbnJpvqK.d.mts} RENAMED
@@ -190,11 +190,11 @@ interface UpdateRoleOutput {
190
190
 
191
191
  declare const verifyAccessInputSchema: z.ZodObject<{
192
192
  userId: z.ZodUUID;
193
- accessRequests: z.ZodArray<z.ZodObject<{
193
+ accessRequests: z.ZodArray<z.ZodArray<z.ZodObject<{
194
194
  scope: z.ZodString;
195
195
  resourceId: z.ZodOptional<z.ZodString>;
196
196
  resourcePath: z.ZodOptional<z.ZodString>;
197
- }, z.core.$strip>>;
197
+ }, z.core.$strip>>>;
198
198
  jwt: z.ZodOptional<z.ZodObject<{
199
199
  sub: z.ZodString;
200
200
  iat: z.ZodNumber;
package/dist/shared/{rbac.CAcqvrNj.d.ts → rbac.DrhiDe1P.d.ts} RENAMED
@@ -190,11 +190,11 @@ interface UpdateRoleOutput {
190
190
 
191
191
  declare const verifyAccessInputSchema: z.ZodObject<{
192
192
  userId: z.ZodUUID;
193
- accessRequests: z.ZodArray<z.ZodObject<{
193
+ accessRequests: z.ZodArray<z.ZodArray<z.ZodObject<{
194
194
  scope: z.ZodString;
195
195
  resourceId: z.ZodOptional<z.ZodString>;
196
196
  resourcePath: z.ZodOptional<z.ZodString>;
197
- }, z.core.$strip>>;
197
+ }, z.core.$strip>>>;
198
198
  jwt: z.ZodOptional<z.ZodObject<{
199
199
  sub: z.ZodString;
200
200
  iat: z.ZodNumber;
package/dist/shared/{rbac.CUCczegz.mjs → rbac.ihzxYB9Z.mjs} RENAMED
@@ -138,11 +138,13 @@ const coercedJwtPayloadSchema = jwtPayloadSchema.extend({
138
138
  const verifyAccessInputSchema = z.object({
139
139
  userId: z.uuid(),
140
140
  accessRequests: z.array(
141
- z.object({
142
- scope: z.string(),
143
- resourceId: z.string().optional(),
144
- resourcePath: z.string().optional()
145
- })
141
+ z.array(
142
+ z.object({
143
+ scope: z.string(),
144
+ resourceId: z.string().optional(),
145
+ resourcePath: z.string().optional()
146
+ })
147
+ )
146
148
  ),
147
149
  jwt: coercedJwtPayloadSchema.optional()
148
150
  });
package/dist/types.cjs CHANGED
@@ -1,6 +1,6 @@
1
1
  'use strict';
2
2
 
3
- const verifyScope = require('./shared/rbac.B2KUW5xp.cjs');
3
+ const verifyScope = require('./shared/rbac.BZDCYlSt.cjs');
4
4
  require('zod');
5
5
 
6
6
 
package/dist/types.d.cts CHANGED
@@ -1,4 +1,4 @@
1
- export { A as AssignRoleToUserInput, b as AssignRoleToUserOutput, c as AssignRolesToUserInput, d as AssignRolesToUserOutput, C as CreateRoleInput, a as CreateRoleOutput, D as DeleteRoleInput, s as DeleteRoleOutput, o as GetPermissionsOutput, p as GetUserPermissionsInput, q as GetUserPermissionsOutput, k as GrantScopeToRoleInput, l as GrantScopeToRoleOutput, G as GrantScopeToUserInput, f as GrantScopeToUserOutput, g as GrantScopesToUserInput, h as GrantScopesToUserOutput, L as LabeledScope, R as RevokeRoleFromUserInput, e as RevokeRoleFromUserOutput, m as RevokeScopeFromRoleInput, n as RevokeScopeFromRoleOutput, i as RevokeScopeFromUserInput, j as RevokeScopeFromUserOutput, y as RoleInsertType, w as RoleScopeInsertType, v as RoleScopeSelectType, x as RoleSelectType, S as Scope, U as UpdateRoleInput, u as UpdateRoleOutput, B as UserRoleInsertType, z as UserRoleSelectType, F as UserScopeInsertType, E as UserScopeSelectType, V as VerifyAccessInput, r as VerifyAccessOutput, H as assignRoleToUserInputSchema, I as assignRolesToUserInputSchema, J as createRoleInputSchema, K as deleteRoleInputSchema, M as getUserPermissionsInputSchema, N as grantScopeToRoleInputSchema, O as grantScopeToUserInputSchema, P as grantScopesToUserInputSchema, Q as revokeRoleFromUserInputSchema, T as revokeScopeFromRoleInputSchema, W as revokeScopeFromUserInputSchema, X as updateRoleInputSchema, Y as verifyAccessInputSchema } from './shared/rbac.DB0xguAY.cjs';
1
+ export { A as AssignRoleToUserInput, b as AssignRoleToUserOutput, c as AssignRolesToUserInput, d as AssignRolesToUserOutput, C as CreateRoleInput, a as CreateRoleOutput, D as DeleteRoleInput, s as DeleteRoleOutput, o as GetPermissionsOutput, p as GetUserPermissionsInput, q as GetUserPermissionsOutput, k as GrantScopeToRoleInput, l as GrantScopeToRoleOutput, G as GrantScopeToUserInput, f as GrantScopeToUserOutput, g as GrantScopesToUserInput, h as GrantScopesToUserOutput, L as LabeledScope, R as RevokeRoleFromUserInput, e as RevokeRoleFromUserOutput, m as RevokeScopeFromRoleInput, n as RevokeScopeFromRoleOutput, i as RevokeScopeFromUserInput, j as RevokeScopeFromUserOutput, y as RoleInsertType, w as RoleScopeInsertType, v as RoleScopeSelectType, x as RoleSelectType, S as Scope, U as UpdateRoleInput, u as UpdateRoleOutput, B as UserRoleInsertType, z as UserRoleSelectType, F as UserScopeInsertType, E as UserScopeSelectType, V as VerifyAccessInput, r as VerifyAccessOutput, H as assignRoleToUserInputSchema, I as assignRolesToUserInputSchema, J as createRoleInputSchema, K as deleteRoleInputSchema, M as getUserPermissionsInputSchema, N as grantScopeToRoleInputSchema, O as grantScopeToUserInputSchema, P as grantScopesToUserInputSchema, Q as revokeRoleFromUserInputSchema, T as revokeScopeFromRoleInputSchema, W as revokeScopeFromUserInputSchema, X as updateRoleInputSchema, Y as verifyAccessInputSchema } from './shared/rbac.B4wUvd3l.cjs';
2
2
  import { z } from 'zod';
3
3
  export { b as RbacServiceEnv, a as RbacServiceEnvironmentConfig, R as RbacServiceWranglerConfig } from './shared/rbac.ClMKyW8J.cjs';
4
4
  import 'drizzle-orm';
package/dist/types.d.mts CHANGED
@@ -1,4 +1,4 @@
1
- export { A as AssignRoleToUserInput, b as AssignRoleToUserOutput, c as AssignRolesToUserInput, d as AssignRolesToUserOutput, C as CreateRoleInput, a as CreateRoleOutput, D as DeleteRoleInput, s as DeleteRoleOutput, o as GetPermissionsOutput, p as GetUserPermissionsInput, q as GetUserPermissionsOutput, k as GrantScopeToRoleInput, l as GrantScopeToRoleOutput, G as GrantScopeToUserInput, f as GrantScopeToUserOutput, g as GrantScopesToUserInput, h as GrantScopesToUserOutput, L as LabeledScope, R as RevokeRoleFromUserInput, e as RevokeRoleFromUserOutput, m as RevokeScopeFromRoleInput, n as RevokeScopeFromRoleOutput, i as RevokeScopeFromUserInput, j as RevokeScopeFromUserOutput, y as RoleInsertType, w as RoleScopeInsertType, v as RoleScopeSelectType, x as RoleSelectType, S as Scope, U as UpdateRoleInput, u as UpdateRoleOutput, B as UserRoleInsertType, z as UserRoleSelectType, F as UserScopeInsertType, E as UserScopeSelectType, V as VerifyAccessInput, r as VerifyAccessOutput, H as assignRoleToUserInputSchema, I as assignRolesToUserInputSchema, J as createRoleInputSchema, K as deleteRoleInputSchema, M as getUserPermissionsInputSchema, N as grantScopeToRoleInputSchema, O as grantScopeToUserInputSchema, P as grantScopesToUserInputSchema, Q as revokeRoleFromUserInputSchema, T as revokeScopeFromRoleInputSchema, W as revokeScopeFromUserInputSchema, X as updateRoleInputSchema, Y as verifyAccessInputSchema } from './shared/rbac.CocWK7y6.mjs';
1
+ export { A as AssignRoleToUserInput, b as AssignRoleToUserOutput, c as AssignRolesToUserInput, d as AssignRolesToUserOutput, C as CreateRoleInput, a as CreateRoleOutput, D as DeleteRoleInput, s as DeleteRoleOutput, o as GetPermissionsOutput, p as GetUserPermissionsInput, q as GetUserPermissionsOutput, k as GrantScopeToRoleInput, l as GrantScopeToRoleOutput, G as GrantScopeToUserInput, f as GrantScopeToUserOutput, g as GrantScopesToUserInput, h as GrantScopesToUserOutput, L as LabeledScope, R as RevokeRoleFromUserInput, e as RevokeRoleFromUserOutput, m as RevokeScopeFromRoleInput, n as RevokeScopeFromRoleOutput, i as RevokeScopeFromUserInput, j as RevokeScopeFromUserOutput, y as RoleInsertType, w as RoleScopeInsertType, v as RoleScopeSelectType, x as RoleSelectType, S as Scope, U as UpdateRoleInput, u as UpdateRoleOutput, B as UserRoleInsertType, z as UserRoleSelectType, F as UserScopeInsertType, E as UserScopeSelectType, V as VerifyAccessInput, r as VerifyAccessOutput, H as assignRoleToUserInputSchema, I as assignRolesToUserInputSchema, J as createRoleInputSchema, K as deleteRoleInputSchema, M as getUserPermissionsInputSchema, N as grantScopeToRoleInputSchema, O as grantScopeToUserInputSchema, P as grantScopesToUserInputSchema, Q as revokeRoleFromUserInputSchema, T as revokeScopeFromRoleInputSchema, W as revokeScopeFromUserInputSchema, X as updateRoleInputSchema, Y as verifyAccessInputSchema } from './shared/rbac.DbnJpvqK.mjs';
2
2
  import { z } from 'zod';
3
3
  export { b as RbacServiceEnv, a as RbacServiceEnvironmentConfig, R as RbacServiceWranglerConfig } from './shared/rbac.ClMKyW8J.mjs';
4
4
  import 'drizzle-orm';
package/dist/types.d.ts CHANGED
@@ -1,4 +1,4 @@
1
- export { A as AssignRoleToUserInput, b as AssignRoleToUserOutput, c as AssignRolesToUserInput, d as AssignRolesToUserOutput, C as CreateRoleInput, a as CreateRoleOutput, D as DeleteRoleInput, s as DeleteRoleOutput, o as GetPermissionsOutput, p as GetUserPermissionsInput, q as GetUserPermissionsOutput, k as GrantScopeToRoleInput, l as GrantScopeToRoleOutput, G as GrantScopeToUserInput, f as GrantScopeToUserOutput, g as GrantScopesToUserInput, h as GrantScopesToUserOutput, L as LabeledScope, R as RevokeRoleFromUserInput, e as RevokeRoleFromUserOutput, m as RevokeScopeFromRoleInput, n as RevokeScopeFromRoleOutput, i as RevokeScopeFromUserInput, j as RevokeScopeFromUserOutput, y as RoleInsertType, w as RoleScopeInsertType, v as RoleScopeSelectType, x as RoleSelectType, S as Scope, U as UpdateRoleInput, u as UpdateRoleOutput, B as UserRoleInsertType, z as UserRoleSelectType, F as UserScopeInsertType, E as UserScopeSelectType, V as VerifyAccessInput, r as VerifyAccessOutput, H as assignRoleToUserInputSchema, I as assignRolesToUserInputSchema, J as createRoleInputSchema, K as deleteRoleInputSchema, M as getUserPermissionsInputSchema, N as grantScopeToRoleInputSchema, O as grantScopeToUserInputSchema, P as grantScopesToUserInputSchema, Q as revokeRoleFromUserInputSchema, T as revokeScopeFromRoleInputSchema, W as revokeScopeFromUserInputSchema, X as updateRoleInputSchema, Y as verifyAccessInputSchema } from './shared/rbac.CAcqvrNj.js';
1
+ export { A as AssignRoleToUserInput, b as AssignRoleToUserOutput, c as AssignRolesToUserInput, d as AssignRolesToUserOutput, C as CreateRoleInput, a as CreateRoleOutput, D as DeleteRoleInput, s as DeleteRoleOutput, o as GetPermissionsOutput, p as GetUserPermissionsInput, q as GetUserPermissionsOutput, k as GrantScopeToRoleInput, l as GrantScopeToRoleOutput, G as GrantScopeToUserInput, f as GrantScopeToUserOutput, g as GrantScopesToUserInput, h as GrantScopesToUserOutput, L as LabeledScope, R as RevokeRoleFromUserInput, e as RevokeRoleFromUserOutput, m as RevokeScopeFromRoleInput, n as RevokeScopeFromRoleOutput, i as RevokeScopeFromUserInput, j as RevokeScopeFromUserOutput, y as RoleInsertType, w as RoleScopeInsertType, v as RoleScopeSelectType, x as RoleSelectType, S as Scope, U as UpdateRoleInput, u as UpdateRoleOutput, B as UserRoleInsertType, z as UserRoleSelectType, F as UserScopeInsertType, E as UserScopeSelectType, V as VerifyAccessInput, r as VerifyAccessOutput, H as assignRoleToUserInputSchema, I as assignRolesToUserInputSchema, J as createRoleInputSchema, K as deleteRoleInputSchema, M as getUserPermissionsInputSchema, N as grantScopeToRoleInputSchema, O as grantScopeToUserInputSchema, P as grantScopesToUserInputSchema, Q as revokeRoleFromUserInputSchema, T as revokeScopeFromRoleInputSchema, W as revokeScopeFromUserInputSchema, X as updateRoleInputSchema, Y as verifyAccessInputSchema } from './shared/rbac.DrhiDe1P.js';
2
2
  import { z } from 'zod';
3
3
  export { b as RbacServiceEnv, a as RbacServiceEnvironmentConfig, R as RbacServiceWranglerConfig } from './shared/rbac.ClMKyW8J.js';
4
4
  import 'drizzle-orm';
package/dist/types.mjs CHANGED
@@ -1,2 +1,2 @@
1
- export { a as assignRoleToUserInputSchema, b as assignRolesToUserInputSchema, c as createRoleInputSchema, d as deleteRoleInputSchema, g as getUserPermissionsInputSchema, e as grantScopeToRoleInputSchema, f as grantScopeToUserInputSchema, h as grantScopesToUserInputSchema, r as revokeRoleFromUserInputSchema, i as revokeScopeFromRoleInputSchema, j as revokeScopeFromUserInputSchema, u as updateRoleInputSchema, v as verifyAccessInputSchema, k as verifyScopeInputSchema, l as verifyScopeOutputSchema } from './shared/rbac.CUCczegz.mjs';
1
+ export { a as assignRoleToUserInputSchema, b as assignRolesToUserInputSchema, c as createRoleInputSchema, d as deleteRoleInputSchema, g as getUserPermissionsInputSchema, e as grantScopeToRoleInputSchema, f as grantScopeToUserInputSchema, h as grantScopesToUserInputSchema, r as revokeRoleFromUserInputSchema, i as revokeScopeFromRoleInputSchema, j as revokeScopeFromUserInputSchema, u as updateRoleInputSchema, v as verifyAccessInputSchema, k as verifyScopeInputSchema, l as verifyScopeOutputSchema } from './shared/rbac.ihzxYB9Z.mjs';
2
2
  import 'zod';
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@develit-services/rbac",
3
- "version": "0.2.2",
3
+ "version": "0.3.0",
4
4
  "author": "Develit.io s.r.o.",
5
5
  "type": "module",
6
6
  "exports": {