@dudousxd/nestjs-authz-prisma 0.3.2 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +29 -0
- package/README.md +43 -0
- package/dist/authz-rbac.module.d.ts +5 -0
- package/dist/authz-rbac.module.d.ts.map +1 -1
- package/dist/authz-rbac.module.js +3 -2
- package/dist/authz-rbac.module.js.map +1 -1
- package/dist/index.d.ts +2 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1 -1
- package/dist/index.js.map +1 -1
- package/dist/prisma-authz.store.d.ts +34 -8
- package/dist/prisma-authz.store.d.ts.map +1 -1
- package/dist/prisma-authz.store.js +86 -13
- package/dist/prisma-authz.store.js.map +1 -1
- package/dist/prisma-client.d.ts +21 -1
- package/dist/prisma-client.d.ts.map +1 -1
- package/dist/prisma-client.js +5 -1
- package/dist/prisma-client.js.map +1 -1
- package/package.json +27 -23
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,34 @@
|
|
|
1
1
|
# @dudousxd/nestjs-authz-prisma
|
|
2
2
|
|
|
3
|
+
## 0.4.0
|
|
4
|
+
|
|
5
|
+
### Minor Changes
|
|
6
|
+
|
|
7
|
+
- [#58](https://github.com/DavideCarvalho/nestjs-authz/pull/58) [`8b65088`](https://github.com/DavideCarvalho/nestjs-authz/commit/8b6508804216d46384ec3a734a55b9c0ac1e48b6) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Per-source role assignments (manual vs SSO/SCIM/…).
|
|
8
|
+
|
|
9
|
+
Each role assignment now records a `source`, default `'manual'`. Every store adapter gains:
|
|
10
|
+
|
|
11
|
+
- `setUserRoles(user, roleNames, { source?, tenantId? })` replaces only that source's assignments, so an SSO sync never removes a role that was granted by hand. It creates missing roles and runs in a transaction.
|
|
12
|
+
- `assignRole(user, role, { source })` and `removeRole(user, role, { source })`. Without `source`, `removeRole` removes the role from every source.
|
|
13
|
+
- `getRoleAssignments(user, scope?)` returns `{ role, source, tenantId }[]`.
|
|
14
|
+
- `getRolesForUser` and the Gate seams still return distinct role names.
|
|
15
|
+
|
|
16
|
+
Core's `store-kit` exports `DEFAULT_ROLE_SOURCE` and `RoleAssignment`. The adapters now require `@dudousxd/nestjs-authz >= 0.7.0`.
|
|
17
|
+
|
|
18
|
+
**Migration**
|
|
19
|
+
|
|
20
|
+
- **TypeORM:** `ensureAuthzSchema` / `autoCreateSchema` adds `source varchar(64) NOT NULL DEFAULT 'manual'` to `authz_user_role`, so existing rows become manual assignments. It never rewrites an existing primary key. Until you widen the key, a role can come from only one source per user, and a second-source insert is silently ignored. Widen it once:
|
|
21
|
+
|
|
22
|
+
- PostgreSQL: `ALTER TABLE authz_user_role DROP CONSTRAINT <pk_name>, ADD PRIMARY KEY ("userType","userId","roleId","tenantId","source");`
|
|
23
|
+
- MySQL (utf8mb4 needs the shorter key columns): `ALTER TABLE authz_user_role MODIFY roleId varchar(64) NOT NULL, MODIFY source varchar(64) NOT NULL DEFAULT 'manual', DROP PRIMARY KEY, ADD PRIMARY KEY (userType, userId, roleId, tenantId, source);`
|
|
24
|
+
- SQLite: rebuild the table.
|
|
25
|
+
|
|
26
|
+
New tables are created with the 5-column key, and `roleId` is now `varchar(64)` so the key fits MySQL's 3072-byte limit.
|
|
27
|
+
|
|
28
|
+
- **MikroORM:** the column self-heals the same way. The PK does not. See the adapter README for the SQL.
|
|
29
|
+
- **Prisma:** opt-in with `roleSources: true` after adding `source String @default("manual")` to `UserRole` and including it in `@@id`. See the adapter README. Without the option the adapter behaves exactly as before.
|
|
30
|
+
- **Drizzle:** `createAuthzTables()` now includes the column and the widened key, so regenerate with drizzle-kit. `ensureSchema()` adds the column. See the README for the key SQL.
|
|
31
|
+
|
|
3
32
|
## 0.3.2
|
|
4
33
|
|
|
5
34
|
### Patch Changes
|
package/README.md
CHANGED
|
@@ -102,6 +102,49 @@ gate.forUser(user).allows('posts.publish'); // true (PERMISSION_PROVIDER seam)
|
|
|
102
102
|
gate.forUser(user).hasRole('editor'); // true (ROLE_PROVIDER seam)
|
|
103
103
|
```
|
|
104
104
|
|
|
105
|
+
## Role sources (manual vs SSO/SCIM)
|
|
106
|
+
|
|
107
|
+
Every role assignment records a `source`. It defaults to `'manual'`, so existing calls and existing
|
|
108
|
+
rows keep their meaning. Needs `roleSources: true`, as described below. A sync replaces only its own source:
|
|
109
|
+
|
|
110
|
+
```ts
|
|
111
|
+
// On each SSO login: exactly these roles come from SSO. Manual grants are untouched.
|
|
112
|
+
await store.setUserRoles(user, rolesFromIdpGroups, { source: 'sso' });
|
|
113
|
+
|
|
114
|
+
await store.assignRole(user, 'editor'); // source 'manual'
|
|
115
|
+
await store.assignRole(user, 'editor', { source: 'scim' }); // a second assignment of the same role
|
|
116
|
+
await store.removeRole(user, 'editor', { source: 'scim' }); // still an editor (manual)
|
|
117
|
+
await store.removeRole(user, 'editor'); // no source: removed from every source
|
|
118
|
+
await store.getRoleAssignments(user); // [{ role, source, tenantId }]
|
|
119
|
+
```
|
|
120
|
+
|
|
121
|
+
`getRolesForUser` and the Gate seams see the distinct role names from all sources.
|
|
122
|
+
|
|
123
|
+
### Enabling it (schema change)
|
|
124
|
+
|
|
125
|
+
Prisma is schema-first, so per-source assignments are **opt-in**. With the default
|
|
126
|
+
`roleSources: false`, the store never sends a `source` field and your current schema keeps
|
|
127
|
+
working. `setUserRoles` then replaces *all* of the user's roles, and a non-default `source`
|
|
128
|
+
throws. To enable per-source assignments:
|
|
129
|
+
|
|
130
|
+
```prisma
|
|
131
|
+
model UserRole {
|
|
132
|
+
userType String
|
|
133
|
+
userId String
|
|
134
|
+
roleId String
|
|
135
|
+
source String @default("manual")
|
|
136
|
+
|
|
137
|
+
@@id([userType, userId, roleId, source])
|
|
138
|
+
@@index([userType, userId])
|
|
139
|
+
@@map("authz_user_role")
|
|
140
|
+
}
|
|
141
|
+
```
|
|
142
|
+
|
|
143
|
+
Then run `prisma migrate dev`. Existing rows get `source = 'manual'`. Finally, build the store
|
|
144
|
+
with the option: `new PrismaAuthzStore(prisma, { roleSources: true })`, or
|
|
145
|
+
`AuthzRbacModule.forRoot({ client: prisma, roleSources: true })`. `setUserRoles` uses
|
|
146
|
+
`prisma.$transaction` when it's available.
|
|
147
|
+
|
|
105
148
|
## License
|
|
106
149
|
|
|
107
150
|
MIT
|
|
@@ -25,6 +25,11 @@ export interface AuthzRbacModuleOptions {
|
|
|
25
25
|
* for parity; the store's `ensureSchema` is a no-op regardless. Default `false`.
|
|
26
26
|
*/
|
|
27
27
|
autoCreateSchema?: boolean;
|
|
28
|
+
/**
|
|
29
|
+
* Per-source role assignments (see {@link PrismaAuthzStore.setUserRoles}); requires the
|
|
30
|
+
* `source` column on `UserRole`. Only used when the module builds the store from `client`.
|
|
31
|
+
*/
|
|
32
|
+
roleSources?: boolean;
|
|
28
33
|
/**
|
|
29
34
|
* Derive a {@link UserRef} from the Gate's current user. Defaults to
|
|
30
35
|
* {@link defaultUserRefMapper} (`{ type, id }` or `{ id }`).
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authz-rbac.module.d.ts","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EACL,KAAK,aAAa,EAQnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAiB,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE/E,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,eAAoD,CAAC;AAClF,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,eAAsD,CAAC;AAEtF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,GAAG,SAAS,CAAC;AAEnE,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,oFAAoF;IACpF,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,WAAW,CAAC,EAAE,aAAa,CAAC;CAC7B;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,sBAAsB,CAAC,GAAG,sBAAsB,CAAC;CAC9F;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAOvE;
|
|
1
|
+
{"version":3,"file":"authz-rbac.module.d.ts","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EACL,KAAK,aAAa,EAQnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAiB,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE/E,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,eAAoD,CAAC;AAClF,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,eAAsD,CAAC;AAEtF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,GAAG,SAAS,CAAC;AAEnE,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,oFAAoF;IACpF,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,WAAW,CAAC,EAAE,aAAa,CAAC;CAC7B;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,sBAAsB,CAAC,GAAG,sBAAsB,CAAC;CAC9F;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAOvE;AAyED;;;;;;GAMG;AACH,qBACa,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;IAa9D,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,2BAA2B,GAAG,aAAa;IAsBxE,OAAO,CAAC,MAAM,CAAC,eAAe;CAS/B"}
|
|
@@ -34,8 +34,9 @@ export function defaultUserRefMapper(user) {
|
|
|
34
34
|
function resolveStore(options) {
|
|
35
35
|
if (options.store)
|
|
36
36
|
return options.store;
|
|
37
|
-
if (options.client)
|
|
38
|
-
return new PrismaAuthzStore(options.client);
|
|
37
|
+
if (options.client) {
|
|
38
|
+
return new PrismaAuthzStore(options.client, options.roleSources ? { roleSources: true } : {});
|
|
39
|
+
}
|
|
39
40
|
throw new Error('AuthzRbacModule (prisma): provide either `store` or `client` in the options.');
|
|
40
41
|
}
|
|
41
42
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authz-rbac.module.js","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EACL,mBAAmB,EAEnB,aAAa,GAEd,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAEL,MAAM,EACN,UAAU,EACV,MAAM,EAEN,QAAQ,GAGT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3D,oFAAoF;AACpF,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;AAClF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"authz-rbac.module.js","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EACL,mBAAmB,EAEnB,aAAa,GAEd,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAEL,MAAM,EACN,UAAU,EACV,MAAM,EAEN,QAAQ,GAGT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3D,oFAAoF;AACpF,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;AAClF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;AAwCtF,qFAAqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,CAAC,GAAG,IAAwC,CAAC;IACnD,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAqB,CAAC;IACnC,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;AACpE,CAAC;AAED,0FAA0F;AAC1F,SAAS,YAAY,CAAC,OAA+B;IACnD,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACxC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,IAAI,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;AAClG,CAAC;AAED;;;;GAIG;AACH,IACM,sBAAsB,GAD5B,MACM,sBAAsB;IAE+B;IADxC,KAAK,CAAmB;IACzC,YAAyD,OAA+B;QAA/B,YAAO,GAAP,OAAO,CAAwB;QACtF,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IACtE,yEAAyE;IACzE,yDAAyD;IACzD,KAAK,CAAC,aAAa,CAAC,IAAa,EAAE,UAAkB;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACvD,CAAC;CACF,CAAA;AAhBK,sBAAsB;IAD3B,UAAU,EAAE;IAGE,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;;GAFnC,sBAAsB,CAgB3B;AAED;;;;;GAKG;AACH,IACM,gBAAgB,GADtB,MACM,gBAAgB;IAEqC;IADxC,KAAK,CAAmB;IACzC,YAAyD,OAA+B;QAA/B,YAAO,GAAP,OAAO,CAAwB;QACtF,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAa;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;CACF,CAAA;AAZK,gBAAgB;IADrB,UAAU,EAAE;IAGE,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;;GAFnC,gBAAgB,CAYrB;AAED;;;GAGG;AACH,IACM,kBAAkB,GADxB,MACM,kBAAkB;IAEqC;IAD3D,YAC2D,OAAgC;QAAhC,YAAO,GAAP,OAAO,CAAyB;IACxF,CAAC;IAEJ,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,KAAK,IAAI;YAAE,OAAO;QACnD,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,CAAC;IAClD,CAAC;CACF,CAAA;AAVK,kBAAkB;IADvB,UAAU,EAAE;IAGR,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;;GAFrC,kBAAkB,CAUvB;AAED;;;;;;GAMG;AAEI,IAAM,eAAe,uBAArB,MAAM,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAA+B;QAC5C,OAAO;YACL,MAAM,EAAE,iBAAe;YACvB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE;gBACT,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE;gBAClD,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE;gBACtE,GAAG,iBAAe,CAAC,eAAe,EAAE;aACrC;YACD,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,OAAoC;QACtD,OAAO;YACL,MAAM,EAAE,iBAAe;YACvB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAoB;YACnD,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,kBAAkB;oBAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAyB;iBACvD;gBACD;oBACE,OAAO,EAAE,gBAAgB;oBACzB,UAAU,EAAE,CAAC,IAA4B,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC;oBAChE,MAAM,EAAE,CAAC,kBAAkB,CAAC;iBAC7B;gBACD,GAAG,iBAAe,CAAC,eAAe,EAAE;aACrC;YACD,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,CAAC;SAChE,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,eAAe;QAC5B,OAAO;YACL,sBAAsB;YACtB,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,sBAAsB,EAAE;YACrE,gBAAgB;YAChB,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,gBAAgB,EAAE;YACzD,kBAAkB;SACnB,CAAC;IACJ,CAAC;CACF,CAAA;AA7CY,eAAe;IAD3B,MAAM,CAAC,EAAE,CAAC;GACE,eAAe,CA6C3B"}
|
package/dist/index.d.ts
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
|
-
export { PRISMA_CLIENT, type PrismaAuthzClientLike, type PrismaModelDelegate, } from './prisma-client.js';
|
|
1
|
+
export { PRISMA_AUTHZ_STORE_OPTIONS, PRISMA_CLIENT, type PrismaAuthzClientLike, type PrismaAuthzStoreOptions, type PrismaModelDelegate, } from './prisma-client.js';
|
|
2
2
|
export { PrismaAuthzStore } from './prisma-authz.store.js';
|
|
3
|
-
export type { UserAuthz } from './prisma-authz.store.js';
|
|
3
|
+
export type { RoleAssignment, RoleSourceOptions, UserAuthz } from './prisma-authz.store.js';
|
|
4
4
|
export { AUTHZ_RBAC_OPTIONS, AUTHZ_RBAC_STORE, AuthzRbacModule, defaultUserRefMapper, } from './authz-rbac.module.js';
|
|
5
5
|
export type { AuthzRbacModuleAsyncOptions, AuthzRbacModuleOptions, UserRefMapper, } from './authz-rbac.module.js';
|
|
6
6
|
export type { UserRef, UserRefInput } from '@dudousxd/nestjs-authz/store-kit';
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,YAAY,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,aAAa,EACb,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAC5F,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,2BAA2B,EAC3B,sBAAsB,EACtB,aAAa,GACd,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACtD,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
export { PRISMA_CLIENT, } from './prisma-client.js';
|
|
1
|
+
export { PRISMA_AUTHZ_STORE_OPTIONS, PRISMA_CLIENT, } from './prisma-client.js';
|
|
2
2
|
export { PrismaAuthzStore } from './prisma-authz.store.js';
|
|
3
3
|
export { AUTHZ_RBAC_OPTIONS, AUTHZ_RBAC_STORE, AuthzRbacModule, defaultUserRefMapper, } from './authz-rbac.module.js';
|
|
4
4
|
export { applyScope, compileScope } from './scope.js';
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,aAAa,GAId,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}
|
|
@@ -1,6 +1,10 @@
|
|
|
1
|
-
import { type UserAuthz, type UserRef } from '@dudousxd/nestjs-authz/store-kit';
|
|
2
|
-
import { type PrismaAuthzClientLike } from './prisma-client.js';
|
|
3
|
-
export type { UserAuthz };
|
|
1
|
+
import { type RoleAssignment, type UserAuthz, type UserRef } from '@dudousxd/nestjs-authz/store-kit';
|
|
2
|
+
import { type PrismaAuthzClientLike, type PrismaAuthzStoreOptions } from './prisma-client.js';
|
|
3
|
+
export type { RoleAssignment, UserAuthz };
|
|
4
|
+
/** Assignment source for role mutations (default `'manual'`) — see `setUserRoles`. */
|
|
5
|
+
export interface RoleSourceOptions {
|
|
6
|
+
source?: string;
|
|
7
|
+
}
|
|
4
8
|
/**
|
|
5
9
|
* Prisma-backed RBAC store. Receives the app-owned Prisma client via the
|
|
6
10
|
* {@link PRISMA_CLIENT} DI token — NO internal connection ownership, NO `@prisma/client`
|
|
@@ -11,7 +15,13 @@ export type { UserAuthz };
|
|
|
11
15
|
*/
|
|
12
16
|
export declare class PrismaAuthzStore {
|
|
13
17
|
private readonly client;
|
|
14
|
-
|
|
18
|
+
private readonly options;
|
|
19
|
+
constructor(client: PrismaAuthzClientLike, options?: PrismaAuthzStoreOptions);
|
|
20
|
+
/**
|
|
21
|
+
* The `source` filter/value for an assignment: `{ source }` when per-source assignments are on,
|
|
22
|
+
* `{}` otherwise (legacy schema without the column) — where a non-default source is an error.
|
|
23
|
+
*/
|
|
24
|
+
private sourceField;
|
|
15
25
|
/**
|
|
16
26
|
* No-op: Prisma is schema-first / consumer-managed. Declare the RBAC models in your
|
|
17
27
|
* `schema.prisma` (see {@link PrismaAuthzClientLike}) and apply them with
|
|
@@ -29,10 +39,26 @@ export declare class PrismaAuthzStore {
|
|
|
29
39
|
givePermissionToRole(roleName: string, permissionName: string): Promise<void>;
|
|
30
40
|
/** Revoke a permission from a role. No-op if either is absent or not linked. */
|
|
31
41
|
revokePermissionFromRole(roleName: string, permissionName: string): Promise<void>;
|
|
32
|
-
/**
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
42
|
+
/**
|
|
43
|
+
* Assign a role to a user (creating the role by name if needed). Idempotent. `{ source }`
|
|
44
|
+
* (default `'manual'`) needs `roleSources: true`.
|
|
45
|
+
*/
|
|
46
|
+
assignRole(user: UserRef, roleName: string, opts?: RoleSourceOptions): Promise<void>;
|
|
47
|
+
/**
|
|
48
|
+
* Remove a role from a user. No-op if the role or assignment is absent. With `{ source }` only
|
|
49
|
+
* that source's assignment goes; without it, the role is removed from every source.
|
|
50
|
+
*/
|
|
51
|
+
removeRole(user: UserRef, roleName: string, opts?: RoleSourceOptions): Promise<void>;
|
|
52
|
+
/**
|
|
53
|
+
* REPLACE the user's role assignments of ONE source (default `'manual'`) with exactly
|
|
54
|
+
* `roleNames` — e.g. an SSO/SCIM sync calls `setUserRoles(user, mappedRoles, { source: 'sso' })`
|
|
55
|
+
* on every login; other sources' assignments are untouched. Roles are created by name when
|
|
56
|
+
* missing. Atomic when the client has `$transaction`. Without `roleSources: true` there is only
|
|
57
|
+
* one (implicit manual) source, so this replaces ALL of the user's roles.
|
|
58
|
+
*/
|
|
59
|
+
setUserRoles(user: UserRef, roleNames: readonly string[], opts?: RoleSourceOptions): Promise<void>;
|
|
60
|
+
/** Every role assignment of a user, one entry per `(role, source)`. */
|
|
61
|
+
getRoleAssignments(user: UserRef): Promise<RoleAssignment[]>;
|
|
36
62
|
/** The role names a user holds. */
|
|
37
63
|
getRolesForUser(user: UserRef): Promise<string[]>;
|
|
38
64
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"prisma-authz.store.d.ts","sourceRoot":"","sources":["../src/prisma-authz.store.ts"],"names":[],"mappings":"AACA,OAAO,
|
|
1
|
+
{"version":3,"file":"prisma-authz.store.d.ts","sourceRoot":"","sources":["../src/prisma-authz.store.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,OAAO,EAEb,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC7B,MAAM,oBAAoB,CAAC;AAI5B,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;AAE1C,sFAAsF;AACtF,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAOD;;;;;;;GAOG;AACH,qBACa,gBAAgB;IAGzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAGvB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAHP,MAAM,EAAE,qBAAqB,EAG7B,OAAO,GAAE,uBAA4B;IAGxD;;;OAGG;IACH,OAAO,CAAC,WAAW;IAUnB;;;;;OAKG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAMnC,+EAA+E;IACzE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgB/C,qFAAqF;IAC/E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAevC,UAAU;YAKV,gBAAgB;IAO9B,kFAAkF;IAC5E,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUnF,gFAAgF;IAC1E,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASvF;;;OAGG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAW1F;;;OAGG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAU1F;;;;;;OAMG;IACG,YAAY,CAChB,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,IAAI,CAAC;IAkBhB,uEAAuE;IACjE,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAsBlE,mCAAmC;IAC7B,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAWvD;;;;;;;;;;;;;OAaG;IACG,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA0B7D;;;;;OAKG;YACW,0BAA0B;IAiBxC,0DAA0D;IACpD,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAQrD,wEAAwE;IAClE,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAI7E"}
|
|
@@ -11,12 +11,12 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
|
|
|
11
11
|
return function (target, key) { decorator(target, key, paramIndex); }
|
|
12
12
|
};
|
|
13
13
|
import { randomUUID } from 'node:crypto';
|
|
14
|
-
import { normalizeUserRef } from '@dudousxd/nestjs-authz/store-kit';
|
|
15
|
-
import { PRISMA_CLIENT } from './prisma-client.js';
|
|
14
|
+
import { DEFAULT_ROLE_SOURCE, normalizeUserRef, } from '@dudousxd/nestjs-authz/store-kit';
|
|
15
|
+
import { PRISMA_AUTHZ_STORE_OPTIONS, PRISMA_CLIENT, } from './prisma-client.js';
|
|
16
16
|
// Optional Nest DI decorators — declared structurally so this package does not need a
|
|
17
17
|
// hard runtime dependency on @nestjs/common for the POJO store (the module supplies the
|
|
18
18
|
// real Inject token). The store is usable as a plain POJO: `new PrismaAuthzStore(client)`.
|
|
19
|
-
import { Inject, Injectable } from '@nestjs/common';
|
|
19
|
+
import { Inject, Injectable, Optional } from '@nestjs/common';
|
|
20
20
|
/**
|
|
21
21
|
* Prisma-backed RBAC store. Receives the app-owned Prisma client via the
|
|
22
22
|
* {@link PRISMA_CLIENT} DI token — NO internal connection ownership, NO `@prisma/client`
|
|
@@ -27,8 +27,22 @@ import { Inject, Injectable } from '@nestjs/common';
|
|
|
27
27
|
*/
|
|
28
28
|
let PrismaAuthzStore = class PrismaAuthzStore {
|
|
29
29
|
client;
|
|
30
|
-
|
|
30
|
+
options;
|
|
31
|
+
constructor(client, options = {}) {
|
|
31
32
|
this.client = client;
|
|
33
|
+
this.options = options;
|
|
34
|
+
}
|
|
35
|
+
/**
|
|
36
|
+
* The `source` filter/value for an assignment: `{ source }` when per-source assignments are on,
|
|
37
|
+
* `{}` otherwise (legacy schema without the column) — where a non-default source is an error.
|
|
38
|
+
*/
|
|
39
|
+
sourceField(source) {
|
|
40
|
+
if (this.options?.roleSources)
|
|
41
|
+
return { source: source ?? DEFAULT_ROLE_SOURCE };
|
|
42
|
+
if (source !== undefined && source !== DEFAULT_ROLE_SOURCE) {
|
|
43
|
+
throw new Error(`PrismaAuthzStore: role source "${source}" needs per-source assignments — add \`source String @default("manual")\` to the UserRole model (in its @@id) and construct the store with { roleSources: true }.`);
|
|
44
|
+
}
|
|
45
|
+
return {};
|
|
32
46
|
}
|
|
33
47
|
/**
|
|
34
48
|
* No-op: Prisma is schema-first / consumer-managed. Declare the RBAC models in your
|
|
@@ -106,24 +120,81 @@ let PrismaAuthzStore = class PrismaAuthzStore {
|
|
|
106
120
|
await this.client.rolePermission.deleteMany({ where: { roleId, permissionId } });
|
|
107
121
|
}
|
|
108
122
|
// --- user ↔ role ---
|
|
109
|
-
/**
|
|
110
|
-
|
|
123
|
+
/**
|
|
124
|
+
* Assign a role to a user (creating the role by name if needed). Idempotent. `{ source }`
|
|
125
|
+
* (default `'manual'`) needs `roleSources: true`.
|
|
126
|
+
*/
|
|
127
|
+
async assignRole(user, roleName, opts) {
|
|
111
128
|
const { type, id } = normalizeUserRef(user);
|
|
129
|
+
const source = this.sourceField(opts?.source);
|
|
112
130
|
const roleId = await this.createRole(roleName);
|
|
113
131
|
const existing = await this.client.userRole.findFirst({
|
|
114
|
-
where: { userType: type, userId: id, roleId },
|
|
132
|
+
where: { userType: type, userId: id, roleId, ...source },
|
|
115
133
|
});
|
|
116
134
|
if (existing)
|
|
117
135
|
return;
|
|
118
|
-
await this.client.userRole.create({ data: { userType: type, userId: id, roleId } });
|
|
136
|
+
await this.client.userRole.create({ data: { userType: type, userId: id, roleId, ...source } });
|
|
119
137
|
}
|
|
120
|
-
/**
|
|
121
|
-
|
|
138
|
+
/**
|
|
139
|
+
* Remove a role from a user. No-op if the role or assignment is absent. With `{ source }` only
|
|
140
|
+
* that source's assignment goes; without it, the role is removed from every source.
|
|
141
|
+
*/
|
|
142
|
+
async removeRole(user, roleName, opts) {
|
|
122
143
|
const { type, id } = normalizeUserRef(user);
|
|
144
|
+
const source = opts?.source === undefined ? {} : this.sourceField(opts.source);
|
|
123
145
|
const roleId = await this.findRoleId(roleName);
|
|
124
146
|
if (!roleId)
|
|
125
147
|
return;
|
|
126
|
-
await this.client.userRole.deleteMany({
|
|
148
|
+
await this.client.userRole.deleteMany({
|
|
149
|
+
where: { userType: type, userId: id, roleId, ...source },
|
|
150
|
+
});
|
|
151
|
+
}
|
|
152
|
+
/**
|
|
153
|
+
* REPLACE the user's role assignments of ONE source (default `'manual'`) with exactly
|
|
154
|
+
* `roleNames` — e.g. an SSO/SCIM sync calls `setUserRoles(user, mappedRoles, { source: 'sso' })`
|
|
155
|
+
* on every login; other sources' assignments are untouched. Roles are created by name when
|
|
156
|
+
* missing. Atomic when the client has `$transaction`. Without `roleSources: true` there is only
|
|
157
|
+
* one (implicit manual) source, so this replaces ALL of the user's roles.
|
|
158
|
+
*/
|
|
159
|
+
async setUserRoles(user, roleNames, opts) {
|
|
160
|
+
const { type, id } = normalizeUserRef(user);
|
|
161
|
+
const source = this.sourceField(opts?.source);
|
|
162
|
+
const roleIds = [];
|
|
163
|
+
for (const name of new Set(roleNames))
|
|
164
|
+
roleIds.push(await this.createRole(name));
|
|
165
|
+
const replace = async (client) => {
|
|
166
|
+
await client.userRole.deleteMany({ where: { userType: type, userId: id, ...source } });
|
|
167
|
+
for (const roleId of roleIds) {
|
|
168
|
+
await client.userRole.create({ data: { userType: type, userId: id, roleId, ...source } });
|
|
169
|
+
}
|
|
170
|
+
};
|
|
171
|
+
if (typeof this.client.$transaction === 'function') {
|
|
172
|
+
await this.client.$transaction((tx) => replace(tx));
|
|
173
|
+
}
|
|
174
|
+
else {
|
|
175
|
+
await replace(this.client);
|
|
176
|
+
}
|
|
177
|
+
}
|
|
178
|
+
/** Every role assignment of a user, one entry per `(role, source)`. */
|
|
179
|
+
async getRoleAssignments(user) {
|
|
180
|
+
const { type, id } = normalizeUserRef(user);
|
|
181
|
+
const assignments = await this.client.userRole.findMany({
|
|
182
|
+
where: { userType: type, userId: id },
|
|
183
|
+
});
|
|
184
|
+
if (assignments.length === 0)
|
|
185
|
+
return [];
|
|
186
|
+
const roles = await this.client.role.findMany({
|
|
187
|
+
where: { id: { in: [...new Set(assignments.map((a) => a.roleId))] } },
|
|
188
|
+
});
|
|
189
|
+
const nameById = new Map(roles.map((r) => [r.id, r.name]));
|
|
190
|
+
return assignments
|
|
191
|
+
.filter((a) => nameById.has(a.roleId))
|
|
192
|
+
.map((a) => ({
|
|
193
|
+
role: nameById.get(a.roleId),
|
|
194
|
+
source: a.source ?? DEFAULT_ROLE_SOURCE,
|
|
195
|
+
tenantId: null,
|
|
196
|
+
}))
|
|
197
|
+
.sort((a, b) => a.role.localeCompare(b.role) || a.source.localeCompare(b.source));
|
|
127
198
|
}
|
|
128
199
|
// --- queries ---
|
|
129
200
|
/** The role names a user holds. */
|
|
@@ -134,7 +205,7 @@ let PrismaAuthzStore = class PrismaAuthzStore {
|
|
|
134
205
|
});
|
|
135
206
|
if (assignments.length === 0)
|
|
136
207
|
return [];
|
|
137
|
-
const roleIds = assignments.map((a) => a.roleId);
|
|
208
|
+
const roleIds = [...new Set(assignments.map((a) => a.roleId))];
|
|
138
209
|
const roles = await this.client.role.findMany({ where: { id: { in: roleIds } } });
|
|
139
210
|
return roles.map((r) => r.name);
|
|
140
211
|
}
|
|
@@ -217,7 +288,9 @@ let PrismaAuthzStore = class PrismaAuthzStore {
|
|
|
217
288
|
PrismaAuthzStore = __decorate([
|
|
218
289
|
Injectable(),
|
|
219
290
|
__param(0, Inject(PRISMA_CLIENT)),
|
|
220
|
-
|
|
291
|
+
__param(1, Optional()),
|
|
292
|
+
__param(1, Inject(PRISMA_AUTHZ_STORE_OPTIONS)),
|
|
293
|
+
__metadata("design:paramtypes", [Object, Object])
|
|
221
294
|
], PrismaAuthzStore);
|
|
222
295
|
export { PrismaAuthzStore };
|
|
223
296
|
//# sourceMappingURL=prisma-authz.store.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"prisma-authz.store.js","sourceRoot":"","sources":["../src/prisma-authz.store.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,
|
|
1
|
+
{"version":3,"file":"prisma-authz.store.js","sourceRoot":"","sources":["../src/prisma-authz.store.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,mBAAmB,EAInB,gBAAgB,GACjB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,0BAA0B,EAC1B,aAAa,GAGd,MAAM,oBAAoB,CAAC;AAW5B,sFAAsF;AACtF,wFAAwF;AACxF,2FAA2F;AAC3F,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE9D;;;;;;;GAOG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAGR;IAGA;IALnB,YAEmB,MAA6B,EAG7B,UAAmC,EAAE;QAHrC,WAAM,GAAN,MAAM,CAAuB;QAG7B,YAAO,GAAP,OAAO,CAA8B;IACrD,CAAC;IAEJ;;;OAGG;IACK,WAAW,CAAC,MAA0B;QAC5C,IAAI,IAAI,CAAC,OAAO,EAAE,WAAW;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;QAChF,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,mBAAmB,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CACb,kCAAkC,MAAM,mKAAmK,CAC5M,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY;QAChB,6CAA6C;IAC/C,CAAC;IAED,2DAA2D;IAE3D,+EAA+E;IAC/E,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;gBACxC,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;aACrE,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,EAAY,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAC;YACxE,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;gBAC9C,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;aACrE,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,EAAY,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,IAAI,CAAC,CAAC;YAC9E,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAY;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAClE,OAAO,GAAG,EAAE,EAAwB,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACxE,OAAO,GAAG,EAAE,EAAwB,CAAC;IACvC,CAAC;IAED,4BAA4B;IAE5B,kFAAkF;IAClF,KAAK,CAAC,oBAAoB,CAAC,QAAgB,EAAE,cAAsB;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC;YAC1D,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;SAChC,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,wBAAwB,CAAC,QAAgB,EAAE,cAAsB;QACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY;YAAE,OAAO;QACrC,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,sBAAsB;IAEtB;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB,EAAE,IAAwB;QACxE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACpD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE;SACzD,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;IACjG,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB,EAAE,IAAwB;QACxE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;YACpC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE;SACzD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAChB,IAAa,EACb,SAA4B,EAC5B,IAAwB;QAExB,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,KAAK,EAAE,MAA6B,EAAE,EAAE;YACtD,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YACvF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC,CAAC;QACF,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACnD,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAyB,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7E,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,kBAAkB,CAAC,IAAa;QACpC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;SACtC,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC5C,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC,CAAC,EAAE,EAAE;SAChF,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;QAC/E,OAAO,WAAW;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC;aAC/C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAgB,CAAW;YAChD,MAAM,EAAG,CAAC,CAAC,MAA6B,IAAI,mBAAmB;YAC/D,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,kBAAkB;IAElB,mCAAmC;IACnC,KAAK,CAAC,eAAe,CAAC,IAAa;QACjC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;SACtC,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC,CAAC,CAAC;QACzE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,qBAAqB,CAAC,IAAa;QACvC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAE5C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QACvC,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,0EAA0E;gBAC1E,2EAA2E;gBAC3E,2EAA2E;gBAC3E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAyB;;;;;kCAK1B,IAAI,sBAAsB,EAAE;SACrD,CAAC;gBACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;gBACzE,OAAO,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,0BAA0B,CAAC,IAAY,EAAE,EAAU;QAC/D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;SACtC,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;SACnC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAsB,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;YACxD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE;SACrC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,YAAY,CAAC,IAAa;QAC9B,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAC1B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;SACjC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,iBAAiB,CAAC,IAAa,EAAE,UAAkB;QACvD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC3D,OAAO,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;CACF,CAAA;AA/QY,gBAAgB;IAD5B,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,aAAa,CAAC,CAAA;IAErB,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,MAAM,CAAC,0BAA0B,CAAC,CAAA;;GAL1B,gBAAgB,CA+Q5B"}
|
package/dist/prisma-client.d.ts
CHANGED
|
@@ -45,8 +45,10 @@
|
|
|
45
45
|
* userType String
|
|
46
46
|
* userId String
|
|
47
47
|
* roleId String
|
|
48
|
+
* // Only with `roleSources: true` (per-source assignments — see PrismaAuthzStore.setUserRoles):
|
|
49
|
+
* // source String @default("manual")
|
|
48
50
|
*
|
|
49
|
-
* @@id([userType, userId, roleId])
|
|
51
|
+
* @@id([userType, userId, roleId]) // with roleSources: @@id([userType, userId, roleId, source])
|
|
50
52
|
* @@index([userType, userId])
|
|
51
53
|
* @@map("authz_user_role")
|
|
52
54
|
* }
|
|
@@ -124,7 +126,25 @@ export interface PrismaAuthzClientLike {
|
|
|
124
126
|
* (arg/return-position variance), which is exactly what this package avoids.
|
|
125
127
|
*/
|
|
126
128
|
$queryRaw?<T = unknown>(query: TemplateStringsArray, ...values: any[]): Promise<T>;
|
|
129
|
+
/**
|
|
130
|
+
* OPTIONAL interactive transaction (a real `PrismaClient` provides it). Used by
|
|
131
|
+
* `setUserRoles` so the delete + re-insert of one source's assignments is atomic; clients
|
|
132
|
+
* without it run the two steps sequentially.
|
|
133
|
+
*/
|
|
134
|
+
$transaction?(fn: (tx: any) => Promise<unknown>): Promise<unknown>;
|
|
135
|
+
}
|
|
136
|
+
/** Options for {@link PrismaAuthzStore}. */
|
|
137
|
+
export interface PrismaAuthzStoreOptions {
|
|
138
|
+
/**
|
|
139
|
+
* Per-source role assignments (`'manual'`, `'sso'`, …). Requires a `source String
|
|
140
|
+
* @default("manual")` column on the `UserRole` model, included in its `@@id`. Default `false`
|
|
141
|
+
* so an existing schema keeps working unchanged; with it off, `source` options and
|
|
142
|
+
* `setUserRoles(…, { source })` for a non-default source throw.
|
|
143
|
+
*/
|
|
144
|
+
roleSources?: boolean;
|
|
127
145
|
}
|
|
146
|
+
/** DI token for optional {@link PrismaAuthzStoreOptions}. */
|
|
147
|
+
export declare const PRISMA_AUTHZ_STORE_OPTIONS: unique symbol;
|
|
128
148
|
/**
|
|
129
149
|
* DI token for the app-provided Prisma client ({@link PrismaAuthzClientLike})
|
|
130
150
|
* injected into {@link PrismaAuthzStore}.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"prisma-client.d.ts","sourceRoot":"","sources":["../src/prisma-client.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"prisma-client.d.ts","sourceRoot":"","sources":["../src/prisma-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAElC,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAE1C,SAAS,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAE9C,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAE/C,UAAU,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9D;AAED,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,UAAU,EAAE,mBAAmB,CAAC;IAChC,cAAc,EAAE,mBAAmB,CAAC;IACpC,QAAQ,EAAE,mBAAmB,CAAC;IAE9B;;;;;;;;;;;;OAYG;IAEH,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAEnF;;;;OAIG;IAEH,YAAY,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpE;AAED,4CAA4C;AAC5C,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,6DAA6D;AAC7D,eAAO,MAAM,0BAA0B,eAA4D,CAAC;AAEpG;;;GAGG;AACH,eAAO,MAAM,aAAa,eAAqD,CAAC"}
|
package/dist/prisma-client.js
CHANGED
|
@@ -45,8 +45,10 @@
|
|
|
45
45
|
* userType String
|
|
46
46
|
* userId String
|
|
47
47
|
* roleId String
|
|
48
|
+
* // Only with `roleSources: true` (per-source assignments — see PrismaAuthzStore.setUserRoles):
|
|
49
|
+
* // source String @default("manual")
|
|
48
50
|
*
|
|
49
|
-
* @@id([userType, userId, roleId])
|
|
51
|
+
* @@id([userType, userId, roleId]) // with roleSources: @@id([userType, userId, roleId, source])
|
|
50
52
|
* @@index([userType, userId])
|
|
51
53
|
* @@map("authz_user_role")
|
|
52
54
|
* }
|
|
@@ -79,6 +81,8 @@
|
|
|
79
81
|
* on any failure — correctness is preserved everywhere; speed is gained on the common
|
|
80
82
|
* (Postgres + documented schema) case.
|
|
81
83
|
*/
|
|
84
|
+
/** DI token for optional {@link PrismaAuthzStoreOptions}. */
|
|
85
|
+
export const PRISMA_AUTHZ_STORE_OPTIONS = Symbol.for('@dudousxd/nestjs-authz-prisma:store-options');
|
|
82
86
|
/**
|
|
83
87
|
* DI token for the app-provided Prisma client ({@link PrismaAuthzClientLike})
|
|
84
88
|
* injected into {@link PrismaAuthzStore}.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"prisma-client.js","sourceRoot":"","sources":["../src/prisma-client.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"prisma-client.js","sourceRoot":"","sources":["../src/prisma-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AAiEH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;AAEpG;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@dudousxd/nestjs-authz-prisma",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.4.0",
|
|
4
4
|
"description": "Prisma RBAC persistence for @dudousxd/nestjs-authz — roles, permissions, and a Gate seam (zero connection ownership, structural client).",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"repository": {
|
|
@@ -8,6 +8,19 @@
|
|
|
8
8
|
"url": "git+https://github.com/DavideCarvalho/nestjs-authz.git",
|
|
9
9
|
"directory": "packages/prisma"
|
|
10
10
|
},
|
|
11
|
+
"homepage": "https://davidecarvalho.github.io/aviary/docs/authz",
|
|
12
|
+
"bugs": {
|
|
13
|
+
"url": "https://github.com/DavideCarvalho/nestjs-authz/issues"
|
|
14
|
+
},
|
|
15
|
+
"keywords": [
|
|
16
|
+
"nestjs",
|
|
17
|
+
"authorization",
|
|
18
|
+
"authz",
|
|
19
|
+
"rbac",
|
|
20
|
+
"roles",
|
|
21
|
+
"permissions",
|
|
22
|
+
"prisma"
|
|
23
|
+
],
|
|
11
24
|
"author": "Davi Carvalho <davi@goflip.ai>",
|
|
12
25
|
"type": "module",
|
|
13
26
|
"main": "./dist/index.js",
|
|
@@ -25,37 +38,28 @@
|
|
|
25
38
|
"CHANGELOG.md"
|
|
26
39
|
],
|
|
27
40
|
"peerDependencies": {
|
|
28
|
-
"@dudousxd/nestjs-authz": ">=0.
|
|
41
|
+
"@dudousxd/nestjs-authz": ">=0.7.0",
|
|
29
42
|
"@nestjs/common": ">=10.0.0",
|
|
30
43
|
"@nestjs/core": ">=10.0.0",
|
|
31
44
|
"reflect-metadata": ">=0.1.13"
|
|
32
45
|
},
|
|
33
46
|
"devDependencies": {
|
|
34
|
-
"@nestjs/common": "
|
|
35
|
-
"@nestjs/core": "
|
|
36
|
-
"@nestjs/testing": "
|
|
37
|
-
"@testcontainers/postgresql": "
|
|
38
|
-
"@types/node": "
|
|
39
|
-
"@types/pg": "
|
|
40
|
-
"pg": "
|
|
41
|
-
"reflect-metadata": "
|
|
42
|
-
"rxjs": "
|
|
43
|
-
"typescript": "
|
|
44
|
-
"vitest": "
|
|
45
|
-
"@dudousxd/nestjs-authz": "^0.
|
|
47
|
+
"@nestjs/common": "12.0.1",
|
|
48
|
+
"@nestjs/core": "12.0.1",
|
|
49
|
+
"@nestjs/testing": "12.0.1",
|
|
50
|
+
"@testcontainers/postgresql": "12.1.0",
|
|
51
|
+
"@types/node": "20.19.43",
|
|
52
|
+
"@types/pg": "8.23.1",
|
|
53
|
+
"pg": "8.23.0",
|
|
54
|
+
"reflect-metadata": "0.2.2",
|
|
55
|
+
"rxjs": "7.8.2",
|
|
56
|
+
"typescript": "5.9.3",
|
|
57
|
+
"vitest": "3.2.7",
|
|
58
|
+
"@dudousxd/nestjs-authz": "^0.7.0"
|
|
46
59
|
},
|
|
47
60
|
"engines": {
|
|
48
61
|
"node": ">=20"
|
|
49
62
|
},
|
|
50
|
-
"keywords": [
|
|
51
|
-
"nestjs",
|
|
52
|
-
"authorization",
|
|
53
|
-
"authz",
|
|
54
|
-
"rbac",
|
|
55
|
-
"roles",
|
|
56
|
-
"permissions",
|
|
57
|
-
"prisma"
|
|
58
|
-
],
|
|
59
63
|
"scripts": {
|
|
60
64
|
"build": "tsc -p tsconfig.json",
|
|
61
65
|
"test": "vitest run --passWithNoTests",
|