@eduzz/miau-client 1.0.2 → 1.0.3

package/.turbo/turbo-build$colon$types.log

@@ -1,4 +1,4 @@
 
-> @eduzz/miau-client@1.0.2 build:types /home/runner/work/eduzz-miau/eduzz-miau/packages/client
+> @eduzz/miau-client@1.0.3 build:types /home/runner/work/eduzz-miau/eduzz-miau/packages/client
 > tsc --emitDeclarationOnly --outDir dist
 

package/dist/MiauClient.d.ts

@@ -1,5 +1,5 @@
 import { type RequestHandler } from 'express';
-import { type SecretEnv, type Permission } from '@eduzz/miau-types';
+import { type SecretEnv, type Permission, type Resource } from '@eduzz/miau-types';
 import { type RequestAugmentation } from './middleware';
 type MiauClientConfig = {
     apiUrl: string;
@@ -11,8 +11,6 @@ export declare class MiauClient {
     private jwtToken;
     private jwksClient;
     private basicAuthToken;
-    private permissionsCache;
-    private permissionsRequests;
     constructor(config: MiauClientConfig);
     getEnvironment(): SecretEnv;
     getPublicKey(kid: string): Promise<string>;
@@ -21,10 +19,11 @@ export declare class MiauClient {
         requestAugmentation?: RequestAugmentation<T>;
         fallbackMiddleware?: RequestHandler;
     }): RequestHandler;
+    getResources(): Promise<Resource[]>;
     getPermissions(targetAppId: string): Promise<Permission>;
-    private requestPermissions;
     private getApiJwtUrl;
     private getPermissionsUrl;
+    private getResourcesUrl;
     private getJwksUrl;
 }
 export {};

package/dist/functions.d.ts

@@ -0,0 +1,3 @@
+import { type Resource } from '@eduzz/miau-types';
+export declare const wildcardToRegex: (pattern: string) => RegExp;
+export declare const isResourceAllowed: (resource: Resource, resources: Resource[], permittedResources: Resource[]) => boolean;

package/dist/functions.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/index.js

@@ -11870,6 +11870,30 @@ var import_jwks_rsa = __toESM(require_src2());
 
 // src/middleware.ts
 var import_jsonwebtoken = __toESM(require_jsonwebtoken());
+
+// src/functions.ts
+var wildcardToRegex = (pattern) => {
+  const escaped = pattern.replace(/[-/\\^$+?.()|[\]{}]/g, "\\$&");
+  const withWildcards = escaped.replace(/\*/g, "[^/]+");
+  const regexStr = `^${withWildcards}$`;
+  return new RegExp(regexStr);
+};
+var isResourceAllowed = (resource, resources, permittedResources) => {
+  const hasExactMatch = resources.some((res) => {
+    return res.method.toLowerCase() === resource.method.toLowerCase() && res.path.toLowerCase() === resource.path.toLowerCase();
+  });
+  if (hasExactMatch) {
+    return permittedResources.some((perm) => {
+      return perm.method.toLowerCase() === resource.method.toLowerCase() && perm.path.toLowerCase() === resource.path.toLowerCase();
+    });
+  }
+  return permittedResources.some((permission) => {
+    const permissionRegex = wildcardToRegex(permission.path);
+    return permission.method.toLowerCase() === resource.method.toLowerCase() && permissionRegex.test(resource.path.toLowerCase());
+  });
+};
+
+// src/middleware.ts
 var HttpError = class _HttpError extends Error {
   constructor(status, name, message) {
     super(message);
@@ -11878,12 +11902,6 @@ var HttpError = class _HttpError extends Error {
     Object.setPrototypeOf(this, _HttpError.prototype);
   }
 };
-var wildcardToRegex = (pattern) => {
-  const escaped = pattern.replace(/[-/\\^$+?.()|[\]{}]/g, "\\$&");
-  const withWildcards = escaped.replace(/\*/g, "[^/]+");
-  const regexStr = `^${withWildcards}$`;
-  return new RegExp(regexStr);
-};
 var miauMiddleware = (miauClient, requestAugmentation, fallbackMiddleware) => {
   return async (req, res, next) => {
     try {
@@ -11908,14 +11926,20 @@ var miauMiddleware = (miauClient, requestAugmentation, fallbackMiddleware) => {
           `Secret environment ${secret.environment} does not match client environment ${miauClient.getEnvironment()}`
         );
       }
+      const resources = await miauClient.getResources();
+      if (!resources) {
+        throw new HttpError(401, "Unauthorized", "No resources found for this application");
+      }
       const permission = await miauClient.getPermissions(application.id);
       if (!permission) {
         throw new HttpError(401, "Unauthorized", "No permissions found for this application");
       }
-      const resources = permission?.resources || [];
-      const isAllowed = resources.some((resource) => {
-        return resource.method.toLowerCase() === req.method.toLowerCase() && wildcardToRegex(resource.path.toLowerCase()).test(req.path.toLowerCase());
-      });
+      const permittedResources = permission?.resources || [];
+      if (!permittedResources.length) {
+        throw new HttpError(403, "Forbidden", "No resources are permitted for this application");
+      }
+      const resource = { protocol: "http", method: req.method, path: req.path };
+      const isAllowed = isResourceAllowed(resource, resources, permittedResources);
       if (!isAllowed) {
         throw new HttpError(403, "Forbidden", `You do not have permission to access ${req.method} ${req.path}`);
       }
@@ -11938,6 +11962,7 @@ var miauMiddleware = (miauClient, requestAugmentation, fallbackMiddleware) => {
 };
 
 // src/MiauClient.ts
+var requestsCache = /* @__PURE__ */ new Map();
 var reusableFetch = async (input, init) => {
   return new Promise(async (resolve, reject) => {
     try {
@@ -11950,16 +11975,36 @@ var reusableFetch = async (input, init) => {
     }
   });
 };
+var cacheableFetch = async (input, init) => {
+  const cacheKeyData = JSON.stringify({ input, init });
+  const cacheKey = import_node_crypto.default.createHash("sha256").update(cacheKeyData).digest("hex");
+  const cachedResponse = requestsCache.get(cacheKey);
+  if (cachedResponse) {
+    const { data, headers } = await cachedResponse;
+    const expiresAt = expiresHeaderToUnixtime(headers.get("Expires"));
+    if (expiresAt > Date.now()) {
+      return data;
+    }
+    requestsCache.delete(cacheKey);
+  }
+  const newRequest = reusableFetch(input, init);
+  requestsCache.set(cacheKey, newRequest);
+  return (await newRequest).data;
+};
+var expiresHeaderToUnixtime = (expires) => {
+  return expires ? new Date(expires).getTime() : Date.now() + 6e4;
+};
 var MiauClient = class {
   constructor(config) {
-    this.permissionsCache = /* @__PURE__ */ new Map();
-    this.permissionsRequests = /* @__PURE__ */ new Map();
     this.getApiJwtUrl = () => {
       return `${this.config.apiUrl}/v1/jwt`;
     };
     this.getPermissionsUrl = () => {
       return `${this.config.apiUrl}/v1/permissions`;
     };
+    this.getResourcesUrl = () => {
+      return `${this.config.apiUrl}/v1/resources`;
+    };
     this.getJwksUrl = () => {
       return `${this.config.apiUrl}/v1/jwks.json`;
     };
@@ -12008,35 +12053,15 @@ var MiauClient = class {
   middleware(config) {
     return miauMiddleware(this, config?.requestAugmentation, config?.fallbackMiddleware);
   }
-  async getPermissions(targetAppId) {
-    if (this.permissionsCache.has(targetAppId)) {
-      const { data, expiresAt } = this.permissionsCache.get(targetAppId);
-      if (expiresAt > Date.now()) {
-        this.permissionsRequests.delete(targetAppId);
-        return data;
-      }
-    }
-    const request = await this.requestPermissions(targetAppId);
-    if (request !== void 0) {
-      const { data, headers } = request;
-      this.permissionsCache.set(targetAppId, {
-        data,
-        expiresAt: headers.has("Expires") ? new Date(headers.get("Expires")).getTime() : Date.now() + 6e4
-        // Default to 1 minute if no Expires header
-      });
-      return data;
-    }
-    throw new Error(`Failed to fetch permissions for app Id: ${targetAppId}`);
+  async getResources() {
+    return cacheableFetch(this.getResourcesUrl(), {
+      headers: { Authorization: `Basic ${this.basicAuthToken}` }
+    });
   }
-  async requestPermissions(sourceAppId) {
-    if (this.permissionsRequests.has(sourceAppId)) {
-      return this.permissionsRequests.get(sourceAppId);
-    }
-    const request = reusableFetch(`${this.getPermissionsUrl()}/${sourceAppId}`, {
+  async getPermissions(targetAppId) {
+    return cacheableFetch(`${this.getPermissionsUrl()}/${targetAppId}`, {
       headers: { Authorization: `Basic ${this.basicAuthToken}` }
     });
-    this.permissionsRequests.set(sourceAppId, request);
-    return request;
   }
 };
 // Annotate the CommonJS export names for ESM import in node: