@dudousxd/nestjs-authz-mikro-orm 0.2.0 → 0.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +64 -0
- package/dist/authz-rbac.module.d.ts +1 -1
- package/dist/authz-rbac.module.d.ts.map +1 -1
- package/dist/authz-rbac.module.js.map +1 -1
- package/dist/index.d.ts +4 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1 -0
- package/dist/index.js.map +1 -1
- package/dist/mikro-orm-authz.store.d.ts +11 -10
- package/dist/mikro-orm-authz.store.d.ts.map +1 -1
- package/dist/mikro-orm-authz.store.js +41 -18
- package/dist/mikro-orm-authz.store.js.map +1 -1
- package/dist/scope.d.ts +52 -0
- package/dist/scope.d.ts.map +1 -0
- package/dist/scope.js +102 -0
- package/dist/scope.js.map +1 -0
- package/dist/types.d.ts +0 -10
- package/dist/types.d.ts.map +1 -1
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,69 @@
|
|
|
1
1
|
# @dudousxd/nestjs-authz-mikro-orm
|
|
2
2
|
|
|
3
|
+
## 0.3.1
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- [`61b6b92`](https://github.com/DavideCarvalho/nestjs-authz/commit/61b6b9241438b8f30811fcd17b0c0c98f08af3bf) - Internal refactors (behavior-preserving): single-source the ORM store contract (`UserRef`/`UserRefInput`/`UserAuthz`/`normalizeUserRef`) via a new `@dudousxd/nestjs-authz/store-kit` subpath that the typeorm/prisma/mikro-orm adapters re-export under their public names, so the definition can't drift across them. Also single-source the grant preamble and the SQL identifier guard in the core store path.
|
|
8
|
+
|
|
9
|
+
## 0.3.0
|
|
10
|
+
|
|
11
|
+
### Minor Changes
|
|
12
|
+
|
|
13
|
+
- [#9](https://github.com/DavideCarvalho/nestjs-authz/pull/9) [`07d01de`](https://github.com/DavideCarvalho/nestjs-authz/commit/07d01de286e7dfcae5fbeb10b7e8d48533214087) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Ecosystem improvements across the authz packages.
|
|
14
|
+
|
|
15
|
+
### Permissions
|
|
16
|
+
|
|
17
|
+
- **Wildcard / hierarchical permissions.** Permission strings now support wildcard
|
|
18
|
+
and hierarchical matching (e.g. `posts:*` or `posts:read:*`), so a single granted
|
|
19
|
+
permission can authorize a family of related actions instead of enumerating each one.
|
|
20
|
+
|
|
21
|
+
### Authorization decisions
|
|
22
|
+
|
|
23
|
+
- **Deny reason / message surfaced on `ForbiddenException`.** When a check fails, the
|
|
24
|
+
reason for the denial is propagated onto the thrown `ForbiddenException`, making it
|
|
25
|
+
possible to return a meaningful message to the caller and to debug authorization
|
|
26
|
+
failures.
|
|
27
|
+
- **Gate `after` hook.** The Gate now exposes an `after` hook that runs once a decision
|
|
28
|
+
has been made, enabling cross-cutting concerns such as auditing, logging, and metrics.
|
|
29
|
+
|
|
30
|
+
### Batch authorization
|
|
31
|
+
|
|
32
|
+
- **`allowsMany`** for evaluating multiple permission checks in a single call.
|
|
33
|
+
- **Batch `/authz/can` endpoint** so clients can resolve many checks in one round trip.
|
|
34
|
+
- **`createCanBatch`** client helper that batches `can` calls transparently.
|
|
35
|
+
|
|
36
|
+
### Performance
|
|
37
|
+
|
|
38
|
+
- **Request-scoped permission cache.** Permissions resolved during a request are cached
|
|
39
|
+
for the lifetime of that request, avoiding repeated lookups on the hot path.
|
|
40
|
+
|
|
41
|
+
### RBAC adapters (TypeORM)
|
|
42
|
+
|
|
43
|
+
- **Direct user permissions** granted to a user independent of their roles.
|
|
44
|
+
- **Tenant-scoped roles** so the same role can be assigned per tenant in multi-tenant
|
|
45
|
+
deployments.
|
|
46
|
+
|
|
47
|
+
### Query scoping / policy filter (ABAC)
|
|
48
|
+
|
|
49
|
+
- **ORM-neutral constraint AST.** Policies can produce a portable constraint
|
|
50
|
+
representation describing which rows a subject may access.
|
|
51
|
+
- **Per-ORM application.** The constraint AST is translated and applied for
|
|
52
|
+
**TypeORM**, **MikroORM**, and **Prisma**, giving ABAC-style query scoping that
|
|
53
|
+
filters data at the database layer regardless of the ORM in use.
|
|
54
|
+
|
|
55
|
+
### Testing
|
|
56
|
+
|
|
57
|
+
- **New `@dudousxd/nestjs-authz-testing` package** with fakes and helpers for testing
|
|
58
|
+
authorization in consumer applications.
|
|
59
|
+
- **Postgres / MySQL testcontainers + contract tests** so the ORM stores are verified
|
|
60
|
+
against real database engines, and a shared contract suite keeps the adapters
|
|
61
|
+
behaviorally consistent.
|
|
62
|
+
|
|
63
|
+
### Housekeeping
|
|
64
|
+
|
|
65
|
+
- **Packaging hygiene** across the published packages.
|
|
66
|
+
|
|
3
67
|
## 0.2.0
|
|
4
68
|
|
|
5
69
|
### Minor Changes
|
|
@@ -1,6 +1,6 @@
|
|
|
1
|
+
import type { UserRef } from '@dudousxd/nestjs-authz/store-kit';
|
|
1
2
|
import { type DynamicModule } from '@nestjs/common';
|
|
2
3
|
import type { MikroOrmAuthzStore } from './mikro-orm-authz.store.js';
|
|
3
|
-
import type { UserRef } from './types.js';
|
|
4
4
|
/** Injection token holding the {@link MikroOrmAuthzStore} the RBAC module manages. */
|
|
5
5
|
export declare const AUTHZ_RBAC_STORE: unique symbol;
|
|
6
6
|
/** Injection token holding the resolved {@link AuthzRbacModuleOptions}. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authz-rbac.module.d.ts","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":"AAMA,OAAO,
|
|
1
|
+
{"version":3,"file":"authz-rbac.module.d.ts","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EACL,KAAK,aAAa,EAQnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAErE,sFAAsF;AACtF,eAAO,MAAM,gBAAgB,eAAuD,CAAC;AACrF,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,eAAyD,CAAC;AAEzF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,GAAG,SAAS,CAAC;AAEnE,MAAM,WAAW,sBAAsB;IACrC,2EAA2E;IAC3E,KAAK,EAAE,kBAAkB,CAAC;IAC1B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,WAAW,CAAC,EAAE,aAAa,CAAC;CAC7B;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,sBAAsB,CAAC,GAAG,sBAAsB,CAAC;CAC9F;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAOvE;AAuDD;;;;;;GAMG;AACH,qBACa,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;IAa9D,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,2BAA2B,GAAG,aAAa;IAsBxE,OAAO,CAAC,MAAM,CAAC,eAAe;CAS/B"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authz-rbac.module.js","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EACL,mBAAmB,EAEnB,aAAa,GAEd,MAAM,wBAAwB,CAAC;
|
|
1
|
+
{"version":3,"file":"authz-rbac.module.js","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EACL,mBAAmB,EAEnB,aAAa,GAEd,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAEL,MAAM,EACN,UAAU,EACV,MAAM,EAEN,QAAQ,GAGT,MAAM,gBAAgB,CAAC;AAGxB,sFAAsF;AACtF,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;AACrF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;AA6BzF,qFAAqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,CAAC,GAAG,IAAwC,CAAC;IACnD,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAqB,CAAC;IACnC,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,IACM,sBAAsB,GAD5B,MACM,sBAAsB;IAC+B;IAAzD,YAAyD,OAA+B;QAA/B,YAAO,GAAP,OAAO,CAAwB;IAAG,CAAC;IAE5F,6EAA6E;IAC7E,sEAAsE;IACtE,yEAAyE;IACzE,yDAAyD;IACzD,KAAK,CAAC,aAAa,CAAC,IAAa,EAAE,UAAkB;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC/D,CAAC;CACF,CAAA;AAbK,sBAAsB;IAD3B,UAAU,EAAE;IAEE,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;;GADnC,sBAAsB,CAa3B;AAED;;;;;GAKG;AACH,IACM,gBAAgB,GADtB,MACM,gBAAgB;IACqC;IAAzD,YAAyD,OAA+B;QAA/B,YAAO,GAAP,OAAO,CAAwB;IAAG,CAAC;IAE5F,KAAK,CAAC,QAAQ,CAAC,IAAa;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;CACF,CAAA;AATK,gBAAgB;IADrB,UAAU,EAAE;IAEE,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;;GADnC,gBAAgB,CASrB;AAED,qFAAqF;AACrF,IACM,kBAAkB,GADxB,MACM,kBAAkB;IAEqC;IAD3D,YAC2D,OAAgC;QAAhC,YAAO,GAAP,OAAO,CAAyB;IACxF,CAAC;IAEJ,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,KAAK,KAAK;YAAE,OAAO;QACpD,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;IAC1C,CAAC;CACF,CAAA;AAVK,kBAAkB;IADvB,UAAU,EAAE;IAGR,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;;GAFrC,kBAAkB,CAUvB;AAED;;;;;;GAMG;AAEI,IAAM,eAAe,uBAArB,MAAM,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAA+B;QAC5C,OAAO;YACL,MAAM,EAAE,iBAAe;YACvB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE;gBACT,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE;gBAClD,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE;gBACtD,GAAG,iBAAe,CAAC,eAAe,EAAE;aACrC;YACD,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,OAAoC;QACtD,OAAO;YACL,MAAM,EAAE,iBAAe;YACvB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAoB;YACnD,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,kBAAkB;oBAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAyB;iBACvD;gBACD;oBACE,OAAO,EAAE,gBAAgB;oBACzB,UAAU,EAAE,CAAC,IAA4B,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK;oBACxD,MAAM,EAAE,CAAC,kBAAkB,CAAC;iBAC7B;gBACD,GAAG,iBAAe,CAAC,eAAe,EAAE;aACrC;YACD,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,CAAC;SAChE,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,eAAe;QAC5B,OAAO;YACL,sBAAsB;YACtB,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,sBAAsB,EAAE;YACrE,gBAAgB;YAChB,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,gBAAgB,EAAE;YACzD,kBAAkB;SACnB,CAAC;IACJ,CAAC;CACF,CAAA;AA7CY,eAAe;IAD3B,MAAM,CAAC,EAAE,CAAC;GACE,eAAe,CA6C3B"}
|
package/dist/index.d.ts
CHANGED
|
@@ -4,5 +4,8 @@ export { MikroOrmAuthzStore } from './mikro-orm-authz.store.js';
|
|
|
4
4
|
export type { UserAuthz } from './mikro-orm-authz.store.js';
|
|
5
5
|
export { AUTHZ_RBAC_OPTIONS, AUTHZ_RBAC_STORE, AuthzRbacModule, defaultUserRefMapper, } from './authz-rbac.module.js';
|
|
6
6
|
export type { AuthzRbacModuleAsyncOptions, AuthzRbacModuleOptions, UserRefMapper, } from './authz-rbac.module.js';
|
|
7
|
-
export type { AuthzStoreOptions
|
|
7
|
+
export type { AuthzStoreOptions } from './types.js';
|
|
8
|
+
export type { UserRef, UserRefInput } from '@dudousxd/nestjs-authz/store-kit';
|
|
9
|
+
export { applyScope, compileScope } from './scope.js';
|
|
10
|
+
export type { ScopeResolver } from './scope.js';
|
|
8
11
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,2BAA2B,EAC3B,sBAAsB,EACtB,aAAa,GACd,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,2BAA2B,EAC3B,sBAAsB,EACtB,aAAa,GACd,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACtD,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -2,4 +2,5 @@ export { AUTHZ_ENTITIES, DEFAULT_TABLE_NAMES, PermissionEntity, RoleEntity, Role
|
|
|
2
2
|
export { authzSchemaSql, ensureAuthzSchema } from './schema.js';
|
|
3
3
|
export { MikroOrmAuthzStore } from './mikro-orm-authz.store.js';
|
|
4
4
|
export { AUTHZ_RBAC_OPTIONS, AUTHZ_RBAC_STORE, AuthzRbacModule, defaultUserRefMapper, } from './authz-rbac.module.js';
|
|
5
|
+
export { applyScope, compileScope } from './scope.js';
|
|
5
6
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}
|
|
@@ -1,13 +1,6 @@
|
|
|
1
|
+
import { type UserAuthz, type UserRef } from '@dudousxd/nestjs-authz/store-kit';
|
|
1
2
|
import type { EntityManager } from '@mikro-orm/core';
|
|
2
|
-
|
|
3
|
-
/**
|
|
4
|
-
* A user's effective permissions: the role names they hold and the flattened set of
|
|
5
|
-
* permission names granted by those roles.
|
|
6
|
-
*/
|
|
7
|
-
export interface UserAuthz {
|
|
8
|
-
roles: string[];
|
|
9
|
-
permissions: string[];
|
|
10
|
-
}
|
|
3
|
+
export type { UserAuthz };
|
|
11
4
|
/**
|
|
12
5
|
* MikroORM-backed RBAC store. A plain POJO that receives the `EntityManager` in its
|
|
13
6
|
* constructor — NOT `@Injectable`, no internal connection token (the app owns the
|
|
@@ -41,7 +34,15 @@ export declare class MikroOrmAuthzStore {
|
|
|
41
34
|
removeRole(user: UserRef, roleName: string): Promise<void>;
|
|
42
35
|
/** The role names a user holds. */
|
|
43
36
|
getRolesForUser(user: UserRef): Promise<string[]>;
|
|
44
|
-
/**
|
|
37
|
+
/**
|
|
38
|
+
* The flattened, distinct permission names a user has via their roles.
|
|
39
|
+
*
|
|
40
|
+
* Resolved in a SINGLE database round-trip via a `permission ← rolePermission ← userRole`
|
|
41
|
+
* join (previously three sequential `find` calls). Table/column names are read from the
|
|
42
|
+
* live entity metadata (not hard-coded) so re-decorated table names keep working. The
|
|
43
|
+
* returned set is the FULL granted permission name set, deduped — callers (incl. the
|
|
44
|
+
* wildcard matcher) rely on getting every granted name (e.g. a granted `posts.*`).
|
|
45
|
+
*/
|
|
45
46
|
getPermissionsForUser(user: UserRef): Promise<string[]>;
|
|
46
47
|
/** A user's roles + effective permissions in one shot. */
|
|
47
48
|
getUserAuthz(user: UserRef): Promise<UserAuthz>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"mikro-orm-authz.store.d.ts","sourceRoot":"","sources":["../src/mikro-orm-authz.store.ts"],"names":[],"mappings":"AACA,OAAO,
|
|
1
|
+
{"version":3,"file":"mikro-orm-authz.store.d.ts","sourceRoot":"","sources":["../src/mikro-orm-authz.store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,OAAO,EAAoB,MAAM,kCAAkC,CAAC;AAClG,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,iBAAiB,CAAC;AAM/D,YAAY,EAAE,SAAS,EAAE,CAAC;AAE1B;;;;;;;;GAQG;AACH,qBAAa,kBAAkB;IAI3B,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa,EAClC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAM;IAGnC,gGAAgG;IAChG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAM7B;;;OAGG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAoB/C,qFAAqF;IAC/E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAoBvC,UAAU;YAKV,gBAAgB;IAO9B,kFAAkF;IAC5E,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUnF,gFAAgF;IAC1E,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASvF,iFAAiF;IAC3E,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUhE,4EAA4E;IACtE,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAShE,mCAAmC;IAC7B,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAUvD;;;;;;;;OAQG;IACG,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAyC7D,0DAA0D;IACpD,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAQrD,wEAAwE;IAClE,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAI7E"}
|
|
@@ -1,13 +1,7 @@
|
|
|
1
1
|
import { randomUUID } from 'node:crypto';
|
|
2
|
+
import { normalizeUserRef } from '@dudousxd/nestjs-authz/store-kit';
|
|
2
3
|
import { PermissionEntity, RoleEntity, RolePermissionEntity, UserRoleEntity } from './entities.js';
|
|
3
4
|
import { ensureAuthzSchema } from './schema.js';
|
|
4
|
-
/** Normalize a {@link UserRef} to `{ type, id }` with `id` stringified. */
|
|
5
|
-
function normalizeUserRef(ref) {
|
|
6
|
-
if (typeof ref === 'string' || typeof ref === 'number') {
|
|
7
|
-
return { type: 'user', id: String(ref) };
|
|
8
|
-
}
|
|
9
|
-
return { type: ref.type ?? 'user', id: String(ref.id) };
|
|
10
|
-
}
|
|
11
5
|
/**
|
|
12
6
|
* MikroORM-backed RBAC store. A plain POJO that receives the `EntityManager` in its
|
|
13
7
|
* constructor — NOT `@Injectable`, no internal connection token (the app owns the
|
|
@@ -138,20 +132,49 @@ export class MikroOrmAuthzStore {
|
|
|
138
132
|
const roles = await em.find(RoleEntity, { id: { $in: roleIds } });
|
|
139
133
|
return roles.map((r) => r.name);
|
|
140
134
|
}
|
|
141
|
-
/**
|
|
135
|
+
/**
|
|
136
|
+
* The flattened, distinct permission names a user has via their roles.
|
|
137
|
+
*
|
|
138
|
+
* Resolved in a SINGLE database round-trip via a `permission ← rolePermission ← userRole`
|
|
139
|
+
* join (previously three sequential `find` calls). Table/column names are read from the
|
|
140
|
+
* live entity metadata (not hard-coded) so re-decorated table names keep working. The
|
|
141
|
+
* returned set is the FULL granted permission name set, deduped — callers (incl. the
|
|
142
|
+
* wildcard matcher) rely on getting every granted name (e.g. a granted `posts.*`).
|
|
143
|
+
*/
|
|
142
144
|
async getPermissionsForUser(user) {
|
|
143
145
|
const { type, id } = normalizeUserRef(user);
|
|
144
146
|
const em = this.em.fork();
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
const
|
|
149
|
-
const
|
|
150
|
-
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
|
|
154
|
-
|
|
147
|
+
// Derive physical table + column names from metadata so we honor re-decorated entities.
|
|
148
|
+
const meta = em.getMetadata();
|
|
149
|
+
const perm = meta.get(PermissionEntity.name);
|
|
150
|
+
const rolePerm = meta.get(RolePermissionEntity.name);
|
|
151
|
+
const userRole = meta.get(UserRoleEntity.name);
|
|
152
|
+
/** First physical column name for an entity property, from live metadata. */
|
|
153
|
+
const col = (m, prop) => {
|
|
154
|
+
const field = m.properties[prop]?.fieldNames?.[0];
|
|
155
|
+
if (!field)
|
|
156
|
+
throw new Error(`Missing column metadata for ${m.className}.${prop}`);
|
|
157
|
+
return field;
|
|
158
|
+
};
|
|
159
|
+
const permTable = perm.tableName;
|
|
160
|
+
const permId = col(perm, 'id');
|
|
161
|
+
const permName = col(perm, 'name');
|
|
162
|
+
const rpTable = rolePerm.tableName;
|
|
163
|
+
const rpRoleId = col(rolePerm, 'roleId');
|
|
164
|
+
const rpPermId = col(rolePerm, 'permissionId');
|
|
165
|
+
const urTable = userRole.tableName;
|
|
166
|
+
const urRoleId = col(userRole, 'roleId');
|
|
167
|
+
const urUserType = col(userRole, 'userType');
|
|
168
|
+
const urUserId = col(userRole, 'userId');
|
|
169
|
+
// Single round-trip: permission ← rolePermission ← userRole. Identifiers come from
|
|
170
|
+
// entity metadata (trusted), values are bound as parameters (no SQL injection surface).
|
|
171
|
+
const sql = `select distinct p.${permName} as name ` +
|
|
172
|
+
`from ${permTable} p ` +
|
|
173
|
+
`inner join ${rpTable} rp on rp.${rpPermId} = p.${permId} ` +
|
|
174
|
+
`inner join ${urTable} ur on ur.${urRoleId} = rp.${rpRoleId} ` +
|
|
175
|
+
`where ur.${urUserType} = ? and ur.${urUserId} = ?`;
|
|
176
|
+
const rows = (await em.getConnection().execute(sql, [type, id]));
|
|
177
|
+
return [...new Set(rows.map((r) => r.name))];
|
|
155
178
|
}
|
|
156
179
|
/** A user's roles + effective permissions in one shot. */
|
|
157
180
|
async getUserAuthz(user) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"mikro-orm-authz.store.js","sourceRoot":"","sources":["../src/mikro-orm-authz.store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"mikro-orm-authz.store.js","sourceRoot":"","sources":["../src/mikro-orm-authz.store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAgC,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAElG,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAMhD;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAkB;IAIV;IAHnB,2FAA2F;IAC3F,qFAAqF;IACrF,YACmB,EAAiB,EAClC,QAA+B,EAAE;QADhB,OAAE,GAAF,EAAE,CAAe;IAEjC,CAAC;IAEJ,gGAAgG;IAChG,YAAY;QACV,OAAO,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,2DAA2D;IAE3D;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE;YACnC,EAAE,EAAE,UAAU,EAAE;YAChB,IAAI;YACJ,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;QACpF,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAC;QACxE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,gBAAgB,EAAE;YACzC,EAAE,EAAE,UAAU,EAAE;YAChB,IAAI;YACJ,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;QACpF,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,IAAI,CAAC,CAAC;QAC9E,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAY;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,OAAO,GAAG,EAAE,EAAE,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,GAAG,EAAE,EAAE,CAAC;IACjB,CAAC;IAED,4BAA4B;IAE5B,kFAAkF;IAClF,KAAK,CAAC,oBAAoB,CAAC,QAAgB,EAAE,cAAsB;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAClF,IAAI,QAAQ;YAAE,OAAO;QACrB,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAC1D,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,wBAAwB,CAAC,QAAgB,EAAE,cAAsB;QACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY;YAAE,OAAO;QACrC,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,sBAAsB;IAEtB,iFAAiF;IACjF,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB;QAC9C,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1F,IAAI,QAAQ;YAAE,OAAO;QACrB,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB;QAC9C,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,kBAAkB;IAElB,mCAAmC;IACnC,KAAK,CAAC,eAAe,CAAC,IAAa;QACjC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAClE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,qBAAqB,CAAC,IAAa;QACvC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAE1B,wFAAwF;QACxF,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAE/C,6EAA6E;QAC7E,MAAM,GAAG,GAAG,CAAC,CAAc,EAAE,IAAY,EAAU,EAAE;YACnD,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC;YAClF,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC;QACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC;QACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAEzC,mFAAmF;QACnF,wFAAwF;QACxF,MAAM,GAAG,GACP,qBAAqB,QAAQ,WAAW;YACxC,QAAQ,SAAS,KAAK;YACtB,cAAc,OAAO,aAAa,QAAQ,QAAQ,MAAM,GAAG;YAC3D,cAAc,OAAO,aAAa,QAAQ,SAAS,QAAQ,GAAG;YAC9D,YAAY,UAAU,eAAe,QAAQ,MAAM,CAAC;QAEtD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAA4B,CAAC;QAC5F,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,YAAY,CAAC,IAAa;QAC9B,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAC1B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;SACjC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,iBAAiB,CAAC,IAAa,EAAE,UAAkB;QACvD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC3D,OAAO,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;CACF"}
|
package/dist/scope.d.ts
ADDED
|
@@ -0,0 +1,52 @@
|
|
|
1
|
+
import type { ScopeConstraint } from '@dudousxd/nestjs-authz';
|
|
2
|
+
import { type FilterQuery } from '@mikro-orm/core';
|
|
3
|
+
import type { Type } from '@nestjs/common';
|
|
4
|
+
/**
|
|
5
|
+
* The minimal scope-resolving surface shared by `Gate` and `BoundGate`. Accepting
|
|
6
|
+
* this (rather than `Gate`) lets the scope helpers take either a Gate (current/context
|
|
7
|
+
* user) or a `gate.forUser(...)` BoundGate without a cast. Mirrors the TypeORM
|
|
8
|
+
* adapter's `ScopeResolver` so all ORMs feel identical.
|
|
9
|
+
*/
|
|
10
|
+
export interface ScopeResolver {
|
|
11
|
+
scope(entity: Type<unknown>, ability?: string): Promise<ScopeConstraint>;
|
|
12
|
+
}
|
|
13
|
+
/**
|
|
14
|
+
* Compile an ORM-neutral {@link ScopeConstraint} into a MikroORM {@link FilterQuery}.
|
|
15
|
+
*
|
|
16
|
+
* Terminal/empty semantics (matching the core AST and the TypeORM adapter):
|
|
17
|
+
* - `allow-all` → `{}` (an empty filter matches EVERY row);
|
|
18
|
+
* - `deny-all` → `{ [raw('1')]: 0 }` (an always-false `WHERE 1 = 0`, matches NO row);
|
|
19
|
+
* - empty `in` → no rows (always-false); empty `nin` → all rows (`{}`);
|
|
20
|
+
* - empty `and` group → all rows; empty `or` group → no rows.
|
|
21
|
+
*
|
|
22
|
+
* Operator mapping:
|
|
23
|
+
* - `eq/ne/gt/gte/lt/lte` → `{ field: { $eq/$ne/$gt/$gte/$lt/$lte: value } }`;
|
|
24
|
+
* - `in/nin` → `{ field: { $in/$nin: [...] } }` (a scalar value is wrapped to a single
|
|
25
|
+
* element);
|
|
26
|
+
* - `isNull` → `{ field: { $eq: null } }`; `isNotNull` → `{ field: { $ne: null } }`;
|
|
27
|
+
* - `and`/`or` → `{ $and: [...] }` / `{ $or: [...] }`.
|
|
28
|
+
*
|
|
29
|
+
* SAFE: only VALUES come from the (untrusted) policy result and MikroORM binds them as
|
|
30
|
+
* parameters. Field names become object keys (a column/property path), so each is
|
|
31
|
+
* validated against {@link assertSafeIdentifier} — a hostile field throws.
|
|
32
|
+
*/
|
|
33
|
+
export declare function compileScope<T extends object = object>(constraint: ScopeConstraint): FilterQuery<T>;
|
|
34
|
+
/**
|
|
35
|
+
* Ergonomic entry point: resolve the query scope for the current (context) user via
|
|
36
|
+
* the {@link Gate} and return the {@link FilterQuery} to pass to `em.find` / a query
|
|
37
|
+
* builder. Equivalent to `compileScope(await gate.scope(entity, ability))`.
|
|
38
|
+
*
|
|
39
|
+
* Mirrors the TypeORM adapter's `applyScope` shape (gate + entity), but returns the
|
|
40
|
+
* filter instead of mutating a query builder, because MikroORM's idiomatic collection
|
|
41
|
+
* fetch is `em.find(Entity, where)`:
|
|
42
|
+
*
|
|
43
|
+
* ```ts
|
|
44
|
+
* const where = await applyScope(gate, Post); // current user's accessible posts
|
|
45
|
+
* const posts = await em.find(Post, where);
|
|
46
|
+
* ```
|
|
47
|
+
*
|
|
48
|
+
* Combine with extra criteria via MikroORM's own `$and`:
|
|
49
|
+
* `em.find(Post, { $and: [where, { published: 1 }] })`.
|
|
50
|
+
*/
|
|
51
|
+
export declare function applyScope<T extends object = object>(gate: ScopeResolver, entity: Type<unknown>, ability?: string): Promise<FilterQuery<T>>;
|
|
52
|
+
//# sourceMappingURL=scope.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../src/scope.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,eAAe,EAGhB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,KAAK,WAAW,EAAO,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC1E;AAyBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,EACpD,UAAU,EAAE,eAAe,GAC1B,WAAW,CAAC,CAAC,CAAC,CAmChB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,UAAU,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,EACxD,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EACrB,OAAO,SAAY,GAClB,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAEzB"}
|
package/dist/scope.js
ADDED
|
@@ -0,0 +1,102 @@
|
|
|
1
|
+
import { assertSafeIdentifier } from '@dudousxd/nestjs-authz';
|
|
2
|
+
import { raw } from '@mikro-orm/core';
|
|
3
|
+
/**
|
|
4
|
+
* An always-false predicate as a MikroORM `FilterQuery`. An empty `$and` is the
|
|
5
|
+
* identity (true) and an empty `$or` is silently dropped by the query builder, so
|
|
6
|
+
* neither reliably encodes "no rows". A `raw(...)` fragment used as a filter KEY is the
|
|
7
|
+
* portable, driver-agnostic way to force an always-false `WHERE`: `{ [raw('1')]: 0 }`
|
|
8
|
+
* compiles to `WHERE 1 = 0`. The fragment is rebuilt on each call because `raw(...)`
|
|
9
|
+
* fragments are single-use (each carries a one-off bound placeholder key).
|
|
10
|
+
*/
|
|
11
|
+
function alwaysFalse() {
|
|
12
|
+
return { [raw('1')]: 0 };
|
|
13
|
+
}
|
|
14
|
+
/** MikroORM operator tokens for the binary comparison operators. */
|
|
15
|
+
const BINARY_OPS = {
|
|
16
|
+
eq: '$eq',
|
|
17
|
+
ne: '$ne',
|
|
18
|
+
gt: '$gt',
|
|
19
|
+
gte: '$gte',
|
|
20
|
+
lt: '$lt',
|
|
21
|
+
lte: '$lte',
|
|
22
|
+
};
|
|
23
|
+
/**
|
|
24
|
+
* Compile an ORM-neutral {@link ScopeConstraint} into a MikroORM {@link FilterQuery}.
|
|
25
|
+
*
|
|
26
|
+
* Terminal/empty semantics (matching the core AST and the TypeORM adapter):
|
|
27
|
+
* - `allow-all` → `{}` (an empty filter matches EVERY row);
|
|
28
|
+
* - `deny-all` → `{ [raw('1')]: 0 }` (an always-false `WHERE 1 = 0`, matches NO row);
|
|
29
|
+
* - empty `in` → no rows (always-false); empty `nin` → all rows (`{}`);
|
|
30
|
+
* - empty `and` group → all rows; empty `or` group → no rows.
|
|
31
|
+
*
|
|
32
|
+
* Operator mapping:
|
|
33
|
+
* - `eq/ne/gt/gte/lt/lte` → `{ field: { $eq/$ne/$gt/$gte/$lt/$lte: value } }`;
|
|
34
|
+
* - `in/nin` → `{ field: { $in/$nin: [...] } }` (a scalar value is wrapped to a single
|
|
35
|
+
* element);
|
|
36
|
+
* - `isNull` → `{ field: { $eq: null } }`; `isNotNull` → `{ field: { $ne: null } }`;
|
|
37
|
+
* - `and`/`or` → `{ $and: [...] }` / `{ $or: [...] }`.
|
|
38
|
+
*
|
|
39
|
+
* SAFE: only VALUES come from the (untrusted) policy result and MikroORM binds them as
|
|
40
|
+
* parameters. Field names become object keys (a column/property path), so each is
|
|
41
|
+
* validated against {@link assertSafeIdentifier} — a hostile field throws.
|
|
42
|
+
*/
|
|
43
|
+
export function compileScope(constraint) {
|
|
44
|
+
if (constraint.kind === 'all')
|
|
45
|
+
return {};
|
|
46
|
+
if (constraint.kind === 'none')
|
|
47
|
+
return alwaysFalse();
|
|
48
|
+
const compileCondition = (c) => {
|
|
49
|
+
assertSafeIdentifier(c.field, `scope field "${c.field}"`);
|
|
50
|
+
if (c.op === 'isNull')
|
|
51
|
+
return { [c.field]: { $eq: null } };
|
|
52
|
+
if (c.op === 'isNotNull')
|
|
53
|
+
return { [c.field]: { $ne: null } };
|
|
54
|
+
if (c.op === 'in' || c.op === 'nin') {
|
|
55
|
+
const values = Array.isArray(c.value) ? c.value : [c.value];
|
|
56
|
+
// An empty `in` matches nothing; an empty `nin` matches everything. Encode both
|
|
57
|
+
// explicitly rather than emitting `{ $in: [] }` (driver-dependent).
|
|
58
|
+
if (values.length === 0) {
|
|
59
|
+
return c.op === 'in' ? alwaysFalse() : {};
|
|
60
|
+
}
|
|
61
|
+
const op = c.op === 'in' ? '$in' : '$nin';
|
|
62
|
+
return { [c.field]: { [op]: values } };
|
|
63
|
+
}
|
|
64
|
+
const token = BINARY_OPS[c.op];
|
|
65
|
+
if (!token)
|
|
66
|
+
throw new Error(`Unsupported scope operator: ${c.op}`);
|
|
67
|
+
return { [c.field]: { [token]: c.value } };
|
|
68
|
+
};
|
|
69
|
+
const compileNode = (node) => {
|
|
70
|
+
if (node.kind === 'condition')
|
|
71
|
+
return compileCondition(node);
|
|
72
|
+
// An empty `and` is the identity (all rows); an empty `or` is the zero (no rows).
|
|
73
|
+
if (node.nodes.length === 0) {
|
|
74
|
+
return node.kind === 'and' ? {} : alwaysFalse();
|
|
75
|
+
}
|
|
76
|
+
const children = node.nodes.map(compileNode);
|
|
77
|
+
const key = node.kind === 'and' ? '$and' : '$or';
|
|
78
|
+
return { [key]: children };
|
|
79
|
+
};
|
|
80
|
+
return compileNode(constraint);
|
|
81
|
+
}
|
|
82
|
+
/**
|
|
83
|
+
* Ergonomic entry point: resolve the query scope for the current (context) user via
|
|
84
|
+
* the {@link Gate} and return the {@link FilterQuery} to pass to `em.find` / a query
|
|
85
|
+
* builder. Equivalent to `compileScope(await gate.scope(entity, ability))`.
|
|
86
|
+
*
|
|
87
|
+
* Mirrors the TypeORM adapter's `applyScope` shape (gate + entity), but returns the
|
|
88
|
+
* filter instead of mutating a query builder, because MikroORM's idiomatic collection
|
|
89
|
+
* fetch is `em.find(Entity, where)`:
|
|
90
|
+
*
|
|
91
|
+
* ```ts
|
|
92
|
+
* const where = await applyScope(gate, Post); // current user's accessible posts
|
|
93
|
+
* const posts = await em.find(Post, where);
|
|
94
|
+
* ```
|
|
95
|
+
*
|
|
96
|
+
* Combine with extra criteria via MikroORM's own `$and`:
|
|
97
|
+
* `em.find(Post, { $and: [where, { published: 1 }] })`.
|
|
98
|
+
*/
|
|
99
|
+
export async function applyScope(gate, entity, ability = 'viewAny') {
|
|
100
|
+
return compileScope(await gate.scope(entity, ability));
|
|
101
|
+
}
|
|
102
|
+
//# sourceMappingURL=scope.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"scope.js","sourceRoot":"","sources":["../src/scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAO9D,OAAO,EAAoB,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAaxD;;;;;;;GAOG;AACH,SAAS,WAAW;IAClB,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAA+B,CAAC;AACxD,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,GACd;IACE,EAAE,EAAE,KAAK;IACT,EAAE,EAAE,KAAK;IACT,EAAE,EAAE,KAAK;IACT,GAAG,EAAE,MAAM;IACX,EAAE,EAAE,KAAK;IACT,GAAG,EAAE,MAAM;CACZ,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,YAAY,CAC1B,UAA2B;IAE3B,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,EAAoB,CAAC;IAC3D,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,WAAW,EAAK,CAAC;IAExD,MAAM,gBAAgB,GAAG,CAAC,CAAiB,EAAkB,EAAE;QAC7D,oBAAoB,CAAC,CAAC,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;QAC1D,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAoB,CAAC;QAC7E,IAAI,CAAC,CAAC,EAAE,KAAK,WAAW;YAAE,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAoB,CAAC;QAChF,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC5D,gFAAgF;YAChF,oEAAoE;YACpE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,EAAK,CAAC,CAAC,CAAE,EAAqB,CAAC;YACnE,CAAC;YACD,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YAC1C,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAoB,CAAC;QAC3D,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnE,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,EAAoB,CAAC;IAC/D,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,IAAe,EAAkB,EAAE;QACtD,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7D,kFAAkF;QAClF,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAE,EAAqB,CAAC,CAAC,CAAC,WAAW,EAAK,CAAC;QACzE,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QACjD,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAoB,CAAC;IAC/C,CAAC,CAAC;IAEF,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAmB,EACnB,MAAqB,EACrB,OAAO,GAAG,SAAS;IAEnB,OAAO,YAAY,CAAI,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAC5D,CAAC"}
|
package/dist/types.d.ts
CHANGED
|
@@ -1,13 +1,3 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* A reference to a user. Matches nestjs-context's `UserRef` shape (`{ type, id }`),
|
|
3
|
-
* but the store accepts either a full ref or a bare id (defaulting `type` to `'user'`).
|
|
4
|
-
*/
|
|
5
|
-
export interface UserRefInput {
|
|
6
|
-
type?: string;
|
|
7
|
-
id: string | number;
|
|
8
|
-
}
|
|
9
|
-
/** A user reference, or just its id (treated as `{ type: 'user', id }`). */
|
|
10
|
-
export type UserRef = UserRefInput | string | number;
|
|
11
1
|
/**
|
|
12
2
|
* Options for the MikroORM RBAC store. Reserved for forward-compatibility — MikroORM
|
|
13
3
|
* derives table names from the registered entities (`@Entity({ tableName })`), so BYO
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;CAAG"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@dudousxd/nestjs-authz-mikro-orm",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.3.1",
|
|
4
4
|
"description": "MikroORM RBAC persistence for @dudousxd/nestjs-authz — roles, permissions, and a Gate seam (zero connection ownership).",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"repository": {
|
|
@@ -49,7 +49,7 @@
|
|
|
49
49
|
"rxjs": "^7.8.1",
|
|
50
50
|
"typescript": "^5.4.0",
|
|
51
51
|
"vitest": "^3.0.0",
|
|
52
|
-
"@dudousxd/nestjs-authz": "^0.
|
|
52
|
+
"@dudousxd/nestjs-authz": "^0.6.1"
|
|
53
53
|
},
|
|
54
54
|
"engines": {
|
|
55
55
|
"node": ">=20"
|