@expressots/core 3.0.0-beta.4 → 4.0.0-preview.1

package/lib/cjs/authorization/services/permission-service.js

@@ -0,0 +1,58 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermissionService = void 0;
+const inversify_js_1 = require("../../di/inversify.js");
+const inject_js_1 = require("../../di/annotation/inject.js");
+const logger_provider_js_1 = require("../../provider/logger/logger.provider.js");
+/**
+ * Tenant-scoped permission service
+ * Each tenant gets isolated permission cache
+ * Note: This is bound manually in setupAuthorization() with tenant scope to allow user overrides
+ */
+let PermissionService = class PermissionService {
+    constructor(logger) {
+        this.logger = logger;
+        this.cache = new Map(); // User ID -> Permissions
+    }
+    /**
+     * Get all permissions for a user
+     * Results are cached per tenant scope
+     */
+    async getPermissions(userId, tenantId) {
+        const cacheKey = `${tenantId || "default"}:${userId}`;
+        if (this.cache.has(cacheKey)) {
+            return this.cache.get(cacheKey);
+        }
+        // In a real implementation, load from database/repository
+        // For now, return empty array (to be implemented by user)
+        this.logger?.warn(`PermissionService.getPermissions() not implemented. Override with your own implementation.`, "permission-service");
+        const permissions = [];
+        this.cache.set(cacheKey, permissions);
+        return permissions;
+    }
+    /**
+     * Check if user has specific permission
+     */
+    async hasPermission(userId, permission, tenantId) {
+        const permissions = await this.getPermissions(userId, tenantId);
+        return permissions.includes(permission);
+    }
+};
+exports.PermissionService = PermissionService;
+exports.PermissionService = PermissionService = __decorate([
+    (0, inversify_js_1.injectable)(),
+    __param(0, (0, inject_js_1.inject)(logger_provider_js_1.Logger)),
+    __metadata("design:paramtypes", [logger_provider_js_1.Logger])
+], PermissionService);

package/lib/cjs/authorization/services/security-context.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/cjs/authorization/services/security-context.js

@@ -0,0 +1,75 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityContext = void 0;
+const inversify_js_1 = require("../../di/inversify.js");
+const inject_js_1 = require("../../di/annotation/inject.js");
+const logger_provider_js_1 = require("../../provider/logger/logger.provider.js");
+/**
+ * Request-scoped security context for caching permissions
+ * Provides permission checking with request-scoped caching
+ * Note: This is bound manually in setupAuthorization() to allow user overrides
+ */
+let SecurityContext = class SecurityContext {
+    constructor(permissionService, logger) {
+        this.permissionService = permissionService;
+        this.logger = logger;
+        this.permissions = new Set();
+        this.roles = new Set();
+        this.loaded = false;
+    }
+    /**
+     * Preload all permissions for user (called once per request)
+     */
+    async preload(userId) {
+        if (this.loaded) {
+            return;
+        }
+        try {
+            if (this.permissionService) {
+                const permissions = await this.permissionService.getPermissions(userId);
+                permissions.forEach((p) => this.permissions.add(p));
+            }
+            this.loaded = true;
+        }
+        catch (error) {
+            this.logger?.error(`Failed to preload permissions for user ${userId}: ${error}`, "security-context");
+        }
+    }
+    /**
+     * Check if user has specific permission
+     */
+    async hasPermission(permission) {
+        return this.permissions.has(permission);
+    }
+    /**
+     * Add permission to context
+     */
+    addPermission(permission) {
+        this.permissions.add(permission);
+    }
+    /**
+     * Get all permissions
+     */
+    async getPermissions() {
+        return Array.from(this.permissions);
+    }
+};
+exports.SecurityContext = SecurityContext;
+exports.SecurityContext = SecurityContext = __decorate([
+    (0, inversify_js_1.injectable)(),
+    __param(0, (0, inject_js_1.inject)("IPermissionService")),
+    __param(1, (0, inject_js_1.inject)(logger_provider_js_1.Logger)),
+    __metadata("design:paramtypes", [Object, logger_provider_js_1.Logger])
+], SecurityContext);

package/lib/cjs/authorization/setup.js

@@ -0,0 +1,141 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultAuthorizationConfig = void 0;
+exports.setupAuthorization = setupAuthorization;
+const guard_registry_js_1 = require("./guard-registry.js");
+const guard_executor_js_1 = require("./guard-executor.js");
+const guard_cache_js_1 = require("./services/guard-cache.js");
+const security_context_js_1 = require("./services/security-context.js");
+const permission_service_js_1 = require("./services/permission-service.js");
+const permission_hierarchy_js_1 = require("./services/permission-hierarchy.js");
+/**
+ * Default authorization configuration
+ */
+exports.defaultAuthorizationConfig = {
+    enablePreloading: true,
+    enableCaching: true,
+    defaultGuardPriority: 100,
+};
+/**
+ * Setup authorization system with optional configuration.
+ *
+ * @layer public
+ * @audience application-developers
+ * @concept authorization-setup
+ * @difficulty beginner
+ *
+ * @summary Quick Start
+ * Registers all required services and initializes guard registry.
+ * Call this in your app's `configureServices()` method.
+ *
+ * @example
+ * ```typescript
+ * export class App extends AppExpress {
+ *   configureServices(): void {
+ *     setupAuthorization(this.container, {
+ *       enablePreloading: true,
+ *       enableCaching: true,
+ *     });
+ *   }
+ * }
+ * ```
+ *
+ * @param container - DI container from your app
+ * @param config - Optional authorization configuration
+ *
+ * @layer internal
+ * @audience framework-developers
+ *
+ * **Internal Architecture**
+ *
+ * This function:
+ * 1. Registers core services (GuardCache, SecurityContext, GuardRegistry, GuardExecutor)
+ * 2. Registers optional services (PermissionService, PermissionHierarchy)
+ * 3. Configures permission hierarchy if provided
+ * 4. Initializes guard registry (auto-discovers guards)
+ *
+ * **Service Registration:**
+ * - `IGuardCache`: Singleton scope (shared cache)
+ * - `ISecurityContext`: Request scope (per-request context)
+ * - `GuardRegistry`: Singleton scope (shared registry)
+ * - `GuardExecutor`: Singleton scope (shared executor)
+ * - `IPermissionService`: Tenant scope (per-tenant permissions)
+ * - `IPermissionHierarchy`: Singleton scope (shared hierarchy)
+ *
+ * @see {@link AuthorizationConfig} for configuration options
+ * @see {@link GuardRegistry} for guard discovery
+ *
+ * @layer advanced
+ * @audience power-users
+ *
+ * **Advanced Configuration**
+ *
+ * With permission hierarchy:
+ * ```typescript
+ * setupAuthorization(this.container, {
+ *   permissionHierarchy: {
+ *     "super-admin": ["admin", "moderator", "user"],
+ *     "admin": ["moderator", "user"],
+ *     "moderator": ["user"]
+ *   }
+ * });
+ * ```
+ *
+ * With custom scope extractors:
+ * ```typescript
+ * setupAuthorization(this.container, {
+ *   scopeExtractors: {
+ *     tenant: (req) => req.headers["x-tenant-id"],
+ *     session: (req) => req.session?.id
+ *   }
+ * });
+ * ```
+ *
+ * @public API
+ */
+function setupAuthorization(container, config = {}) {
+    const finalConfig = { ...exports.defaultAuthorizationConfig, ...config };
+    // Register core services
+    if (!container.isBound("IGuardCache")) {
+        container
+            .bind("IGuardCache")
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            .to(guard_cache_js_1.GuardCache)
+            .inSingletonScope();
+    }
+    if (!container.isBound("ISecurityContext")) {
+        container
+            .bind("ISecurityContext")
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            .to(security_context_js_1.SecurityContext)
+            .inRequestScope();
+    }
+    if (!container.isBound(guard_registry_js_1.GuardRegistry)) {
+        container.bind(guard_registry_js_1.GuardRegistry).toSelf().inSingletonScope();
+    }
+    if (!container.isBound(guard_executor_js_1.GuardExecutor)) {
+        container.bind(guard_executor_js_1.GuardExecutor).toSelf().inSingletonScope();
+    }
+    // Register optional services (can be overridden by user)
+    if (!container.isBound("IPermissionService")) {
+        // Bind with custom scope - inScope() returns BindingWhenOnSyntax which is chainable
+        container
+            .bind("IPermissionService")
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            .to(permission_service_js_1.PermissionService).inScope("tenant");
+    }
+    if (!container.isBound("IPermissionHierarchy")) {
+        container
+            .bind("IPermissionHierarchy")
+            .to(permission_hierarchy_js_1.PermissionHierarchy)
+            .inSingletonScope();
+    }
+    // Configure permission hierarchy if provided
+    if (finalConfig.permissionHierarchy) {
+        const hierarchy = container.get("IPermissionHierarchy");
+        hierarchy.configure(finalConfig.permissionHierarchy);
+    }
+    // Initialize guard registry (auto-discovers guards)
+    const registry = container.get(guard_registry_js_1.GuardRegistry);
+    registry.initialize();
+}