@floristcloud/api-lib 1.2.91 → 1.2.94

package/build/commands/access-policy/get-access-policy.query.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GetAccessPolicyContractQuery = void 0;
+const zod_1 = require("zod");
+const access_policy_schema_1 = require("../../schemas/access-policy/access-policy.schema");
+const GetAccessPolicyResponseSchema = zod_1.z.object({
+    message: zod_1.z.string().optional(),
+    data: access_policy_schema_1.AccessPolicySchema,
+});
+var GetAccessPolicyContractQuery;
+(function (GetAccessPolicyContractQuery) {
+    GetAccessPolicyContractQuery.ResponseSchema = GetAccessPolicyResponseSchema;
+})(GetAccessPolicyContractQuery || (exports.GetAccessPolicyContractQuery = GetAccessPolicyContractQuery = {}));

package/build/commands/access-policy/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./get-access-policy.query"), exports);
+__exportStar(require("./upsert-access-policy.command"), exports);

package/build/commands/access-policy/upsert-access-policy.command.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UpsertAccessPolicyContractCommand = void 0;
+const zod_1 = require("zod");
+const access_policy_schema_1 = require("../../schemas/access-policy/access-policy.schema");
+const UpsertAccessPolicyRequestSchema = access_policy_schema_1.AccessPolicySchema;
+const UpsertAccessPolicyResponseSchema = zod_1.z.object({
+    message: zod_1.z.string().optional(),
+    data: access_policy_schema_1.AccessPolicySchema,
+});
+var UpsertAccessPolicyContractCommand;
+(function (UpsertAccessPolicyContractCommand) {
+    UpsertAccessPolicyContractCommand.RequestSchema = UpsertAccessPolicyRequestSchema;
+    UpsertAccessPolicyContractCommand.ResponseSchema = UpsertAccessPolicyResponseSchema;
+})(UpsertAccessPolicyContractCommand || (exports.UpsertAccessPolicyContractCommand = UpsertAccessPolicyContractCommand = {}));

package/build/commands/index.js

@@ -15,6 +15,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ValidateWsTicketS2SContractQuery = exports.CreateWsTicketContractCommand = exports.ValidateSessionS2SContractQuery = exports.GetActiveSessionsContractQuery = exports.SessionRevokeAllContractCommand = exports.SessionLogoutContractCommand = void 0;
+__exportStar(require("./access-policy"), exports);
 __exportStar(require("./auth"), exports);
 __exportStar(require("./branch"), exports);
 __exportStar(require("./category"), exports);

package/build/commands/user/get-me.query.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GetMeContractQuery = void 0;
+const zod_1 = require("zod");
+const schemas_1 = require("../../schemas");
+const access_policy_schema_1 = require("../../schemas/access-policy/access-policy.schema");
+const GetMeResponseSchema = zod_1.z.object({
+    message: zod_1.z.string().optional(),
+    data: zod_1.z.object({
+        user: schemas_1.UserSchema.omit({ passwordHash: true, restoreTokenHash: true }),
+        permissions: access_policy_schema_1.EffectivePermissionsSchema,
+    }),
+});
+var GetMeContractQuery;
+(function (GetMeContractQuery) {
+    GetMeContractQuery.ResponseSchema = GetMeResponseSchema;
+})(GetMeContractQuery || (exports.GetMeContractQuery = GetMeContractQuery = {}));

package/build/commands/user/index.js

@@ -19,6 +19,7 @@ __exportStar(require("./attachUserToCompany.command"), exports);
 __exportStar(require("./createUserByClientId.command"), exports);
 __exportStar(require("./updateRole.command"), exports);
 __exportStar(require("./getUser.command"), exports);
+__exportStar(require("./get-me.query"), exports);
 __exportStar(require("./createUserForCompany.command"), exports);
 __exportStar(require("./get-user-list.query"), exports);
 __exportStar(require("./get-user-list-s2s.query"), exports);

package/build/constant/error.js

@@ -1229,4 +1229,6 @@ exports.ERRORS = {
         httpCode: 404,
     },
     CONSIGNMENT_TRANSFER_ACCEPT_FAILED: { code: 'CTR013', message: 'Failed to accept consignment transfer request', httpCode: 500 },
+    ACCESS_POLICY_FETCH_FAILED: { code: 'AP001', message: 'Error when retrieving the access policy', httpCode: 500 },
+    ACCESS_POLICY_NOT_UPDATED: { code: 'AP002', message: 'Failed to update the access policy', httpCode: 500 },
 };

package/build/enum/index.js

@@ -108,3 +108,4 @@ __exportStar(require("./moysklad-sync-status.enum"), exports);
 __exportStar(require("./consignment-transfer-request-status.enum"), exports);
 __exportStar(require("./consignment-transfer-direction.enum"), exports);
 __exportStar(require("./legal-identifier-field.enum"), exports);
+__exportStar(require("./permission-key.enum"), exports);

package/build/enum/permission-key.enum.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PERMISSION_KEY_LIST = exports.PermissionKeyEnum = void 0;
+var PermissionKeyEnum;
+(function (PermissionKeyEnum) {
+    PermissionKeyEnum["PRODUCT_VIEW"] = "product.view";
+    PermissionKeyEnum["PRODUCT_EDIT"] = "product.edit";
+    PermissionKeyEnum["PRODUCT_DELETE"] = "product.delete";
+    PermissionKeyEnum["CONSIGNMENT_VIEW"] = "consignment.view";
+    PermissionKeyEnum["CONSIGNMENT_EDIT"] = "consignment.edit";
+    PermissionKeyEnum["CONSIGNMENT_DELETE"] = "consignment.delete";
+    PermissionKeyEnum["COST_VIEW"] = "cost.view";
+})(PermissionKeyEnum || (exports.PermissionKeyEnum = PermissionKeyEnum = {}));
+exports.PERMISSION_KEY_LIST = [
+    PermissionKeyEnum.PRODUCT_VIEW,
+    PermissionKeyEnum.PRODUCT_EDIT,
+    PermissionKeyEnum.PRODUCT_DELETE,
+    PermissionKeyEnum.CONSIGNMENT_VIEW,
+    PermissionKeyEnum.CONSIGNMENT_EDIT,
+    PermissionKeyEnum.CONSIGNMENT_DELETE,
+    PermissionKeyEnum.COST_VIEW,
+];

package/build/schemas/access-policy/access-policy.schema.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeStoredAccessPolicy = exports.EffectivePermissionsSchema = exports.AccessPolicySchema = exports.PermissionMapSchema = exports.CONFIGURABLE_PANEL_ROLE_LIST = void 0;
+const zod_1 = require("zod");
+const permission_key_enum_1 = require("../../enum/permission-key.enum");
+const userRole_enum_1 = require("../../enum/userRole.enum");
+/**
+ * Panel roles that can actually be configured. ADMIN is intentionally excluded:
+ * it always bypasses UI restrictions, so any ADMIN entry in a policy is dead
+ * config. The admin panel must not offer it, and the sanitizer drops it.
+ */
+exports.CONFIGURABLE_PANEL_ROLE_LIST = [userRole_enum_1.UserPanelRoleEnum.MANAGER, userRole_enum_1.UserPanelRoleEnum.EMPLOYEE];
+/**
+ * A sparse map of permission key -> boolean.
+ * Semantics are default-allow: a missing key means "allowed", so in practice
+ * only explicit `false` (denials) are ever stored.
+ */
+exports.PermissionMapSchema = zod_1.z.partialRecord(zod_1.z.nativeEnum(permission_key_enum_1.PermissionKeyEnum), zod_1.z.boolean());
+/**
+ * Full company access policy — the raw configuration edited by an admin.
+ * `roles` holds per-role denials; `users` holds per-employee overrides keyed by userUUID.
+ */
+exports.AccessPolicySchema = zod_1.z.object({
+    roles: zod_1.z.partialRecord(zod_1.z.nativeEnum(userRole_enum_1.UserPanelRoleEnum), exports.PermissionMapSchema).default({}),
+    users: zod_1.z.record(zod_1.z.uuid(), exports.PermissionMapSchema).default({}),
+});
+/**
+ * Resolved permissions for a single user — the sparse denial map after merging
+ * role defaults with the user's own overrides. Empty for ADMIN / global users.
+ * Frontend contract: `can(key) === effective[key] !== false`.
+ */
+exports.EffectivePermissionsSchema = exports.PermissionMapSchema;
+const pickPermissionMap = (value) => {
+    const map = {};
+    if (value && typeof value === 'object') {
+        const record = value;
+        for (const key of permission_key_enum_1.PERMISSION_KEY_LIST) {
+            if (typeof record[key] === 'boolean') {
+                map[key] = record[key];
+            }
+        }
+    }
+    return map;
+};
+/**
+ * Tolerant reader for a stored policy blob. Unlike `AccessPolicySchema.parse`,
+ * this NEVER throws on unknown/renamed keys — it strips anything not in the
+ * current `PermissionKeyEnum` / configurable roles and keeps the rest.
+ *
+ * Why: `AccessPolicySchema` uses `partialRecord`, which throws "Invalid key in
+ * record" on an unknown key. If a permission key or role is ever renamed/removed
+ * while a company still has the old value persisted, a strict parse at the read
+ * boundary would bubble up as a 500 from `getMe` for every user in that company.
+ * Adding keys is safe; removing/renaming must degrade gracefully — hence this.
+ */
+const sanitizeStoredAccessPolicy = (raw) => {
+    const source = raw && typeof raw === 'object' ? raw : {};
+    const roles = {};
+    const rawRoles = source.roles && typeof source.roles === 'object' ? source.roles : {};
+    for (const role of exports.CONFIGURABLE_PANEL_ROLE_LIST) {
+        if (role in rawRoles) {
+            roles[role] = pickPermissionMap(rawRoles[role]);
+        }
+    }
+    const users = {};
+    const rawUsers = source.users && typeof source.users === 'object' ? source.users : {};
+    for (const userUUID of Object.keys(rawUsers)) {
+        users[userUUID] = pickPermissionMap(rawUsers[userUUID]);
+    }
+    return { roles, users };
+};
+exports.sanitizeStoredAccessPolicy = sanitizeStoredAccessPolicy;

package/build/schemas/access-policy/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./access-policy.schema"), exports);

package/build/schemas/index.js

@@ -83,3 +83,4 @@ __exportStar(require("./messenger-profile"), exports);
 __exportStar(require("./error-message.schema"), exports);
 __exportStar(require("./account-deletion-request/account-deletion-request.schema"), exports);
 __exportStar(require("./consignment-transfer"), exports);
+__exportStar(require("./access-policy"), exports);

package/commands/access-policy/get-access-policy.query.ts

@@ -0,0 +1,12 @@
+import { z } from 'zod';
+import { AccessPolicySchema } from '../../schemas/access-policy/access-policy.schema';
+
+const GetAccessPolicyResponseSchema = z.object({
+    message: z.string().optional(),
+    data: AccessPolicySchema,
+});
+
+export namespace GetAccessPolicyContractQuery {
+    export const ResponseSchema = GetAccessPolicyResponseSchema;
+    export type Response = z.infer<typeof ResponseSchema>;
+}

package/commands/access-policy/index.ts

@@ -0,0 +1,2 @@
+export * from './get-access-policy.query';
+export * from './upsert-access-policy.command';

package/commands/access-policy/upsert-access-policy.command.ts

@@ -0,0 +1,17 @@
+import { z } from 'zod';
+import { AccessPolicySchema } from '../../schemas/access-policy/access-policy.schema';
+
+const UpsertAccessPolicyRequestSchema = AccessPolicySchema;
+
+const UpsertAccessPolicyResponseSchema = z.object({
+    message: z.string().optional(),
+    data: AccessPolicySchema,
+});
+
+export namespace UpsertAccessPolicyContractCommand {
+    export const RequestSchema = UpsertAccessPolicyRequestSchema;
+    export type Request = z.infer<typeof RequestSchema>;
+
+    export const ResponseSchema = UpsertAccessPolicyResponseSchema;
+    export type Response = z.infer<typeof ResponseSchema>;
+}

package/commands/index.ts

@@ -1,3 +1,4 @@
+export * from './access-policy';
 export * from './auth';
 export * from './branch';
 export * from './category';

package/commands/user/get-me.query.ts

@@ -0,0 +1,16 @@
+import { z } from 'zod';
+import { UserSchema } from '../../schemas';
+import { EffectivePermissionsSchema } from '../../schemas/access-policy/access-policy.schema';
+
+const GetMeResponseSchema = z.object({
+    message: z.string().optional(),
+    data: z.object({
+        user: UserSchema.omit({ passwordHash: true, restoreTokenHash: true }),
+        permissions: EffectivePermissionsSchema,
+    }),
+});
+
+export namespace GetMeContractQuery {
+    export const ResponseSchema = GetMeResponseSchema;
+    export type Response = z.infer<typeof ResponseSchema>;
+}

package/commands/user/index.ts

@@ -3,6 +3,7 @@ export * from './attachUserToCompany.command';
 export * from './createUserByClientId.command';
 export * from './updateRole.command';
 export * from './getUser.command';
+export * from './get-me.query';
 export * from './createUserForCompany.command';
 export * from './get-user-list.query';
 export * from './get-user-list-s2s.query';

package/constant/error.ts

@@ -1294,4 +1294,6 @@ export const ERRORS = {
         httpCode: 404,
     },
     CONSIGNMENT_TRANSFER_ACCEPT_FAILED: { code: 'CTR013', message: 'Failed to accept consignment transfer request', httpCode: 500 },
+    ACCESS_POLICY_FETCH_FAILED: { code: 'AP001', message: 'Error when retrieving the access policy', httpCode: 500 },
+    ACCESS_POLICY_NOT_UPDATED: { code: 'AP002', message: 'Failed to update the access policy', httpCode: 500 },
 } as const;

package/enum/index.ts

@@ -92,3 +92,4 @@ export * from './moysklad-sync-status.enum';
 export * from './consignment-transfer-request-status.enum';
 export * from './consignment-transfer-direction.enum';
 export * from './legal-identifier-field.enum';
+export * from './permission-key.enum';

package/enum/permission-key.enum.ts

@@ -0,0 +1,19 @@
+export enum PermissionKeyEnum {
+    PRODUCT_VIEW = 'product.view',
+    PRODUCT_EDIT = 'product.edit',
+    PRODUCT_DELETE = 'product.delete',
+    CONSIGNMENT_VIEW = 'consignment.view',
+    CONSIGNMENT_EDIT = 'consignment.edit',
+    CONSIGNMENT_DELETE = 'consignment.delete',
+    COST_VIEW = 'cost.view',
+}
+
+export const PERMISSION_KEY_LIST: PermissionKeyEnum[] = [
+    PermissionKeyEnum.PRODUCT_VIEW,
+    PermissionKeyEnum.PRODUCT_EDIT,
+    PermissionKeyEnum.PRODUCT_DELETE,
+    PermissionKeyEnum.CONSIGNMENT_VIEW,
+    PermissionKeyEnum.CONSIGNMENT_EDIT,
+    PermissionKeyEnum.CONSIGNMENT_DELETE,
+    PermissionKeyEnum.COST_VIEW,
+];

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@floristcloud/api-lib",
-    "version": "1.2.91",
+    "version": "1.2.94",
     "description": "",
     "main": "./build/index.js",
     "scripts": {

package/schemas/access-policy/access-policy.schema.ts

@@ -0,0 +1,80 @@
+import { z } from 'zod';
+import { PermissionKeyEnum, PERMISSION_KEY_LIST } from '../../enum/permission-key.enum';
+import { UserPanelRoleEnum } from '../../enum/userRole.enum';
+
+/**
+ * Panel roles that can actually be configured. ADMIN is intentionally excluded:
+ * it always bypasses UI restrictions, so any ADMIN entry in a policy is dead
+ * config. The admin panel must not offer it, and the sanitizer drops it.
+ */
+export const CONFIGURABLE_PANEL_ROLE_LIST: UserPanelRoleEnum[] = [UserPanelRoleEnum.MANAGER, UserPanelRoleEnum.EMPLOYEE];
+
+/**
+ * A sparse map of permission key -> boolean.
+ * Semantics are default-allow: a missing key means "allowed", so in practice
+ * only explicit `false` (denials) are ever stored.
+ */
+export const PermissionMapSchema = z.partialRecord(z.nativeEnum(PermissionKeyEnum), z.boolean());
+export type PermissionMap = z.infer<typeof PermissionMapSchema>;
+
+/**
+ * Full company access policy — the raw configuration edited by an admin.
+ * `roles` holds per-role denials; `users` holds per-employee overrides keyed by userUUID.
+ */
+export const AccessPolicySchema = z.object({
+    roles: z.partialRecord(z.nativeEnum(UserPanelRoleEnum), PermissionMapSchema).default({}),
+    users: z.record(z.uuid(), PermissionMapSchema).default({}),
+});
+export type AccessPolicy = z.infer<typeof AccessPolicySchema>;
+
+/**
+ * Resolved permissions for a single user — the sparse denial map after merging
+ * role defaults with the user's own overrides. Empty for ADMIN / global users.
+ * Frontend contract: `can(key) === effective[key] !== false`.
+ */
+export const EffectivePermissionsSchema = PermissionMapSchema;
+export type EffectivePermissions = z.infer<typeof EffectivePermissionsSchema>;
+
+const pickPermissionMap = (value: unknown): PermissionMap => {
+    const map: PermissionMap = {};
+    if (value && typeof value === 'object') {
+        const record = value as Record<string, unknown>;
+        for (const key of PERMISSION_KEY_LIST) {
+            if (typeof record[key] === 'boolean') {
+                map[key] = record[key] as boolean;
+            }
+        }
+    }
+    return map;
+};
+
+/**
+ * Tolerant reader for a stored policy blob. Unlike `AccessPolicySchema.parse`,
+ * this NEVER throws on unknown/renamed keys — it strips anything not in the
+ * current `PermissionKeyEnum` / configurable roles and keeps the rest.
+ *
+ * Why: `AccessPolicySchema` uses `partialRecord`, which throws "Invalid key in
+ * record" on an unknown key. If a permission key or role is ever renamed/removed
+ * while a company still has the old value persisted, a strict parse at the read
+ * boundary would bubble up as a 500 from `getMe` for every user in that company.
+ * Adding keys is safe; removing/renaming must degrade gracefully — hence this.
+ */
+export const sanitizeStoredAccessPolicy = (raw: unknown): AccessPolicy => {
+    const source = raw && typeof raw === 'object' ? (raw as Record<string, unknown>) : {};
+
+    const roles: AccessPolicy['roles'] = {};
+    const rawRoles = source.roles && typeof source.roles === 'object' ? (source.roles as Record<string, unknown>) : {};
+    for (const role of CONFIGURABLE_PANEL_ROLE_LIST) {
+        if (role in rawRoles) {
+            roles[role] = pickPermissionMap(rawRoles[role]);
+        }
+    }
+
+    const users: AccessPolicy['users'] = {};
+    const rawUsers = source.users && typeof source.users === 'object' ? (source.users as Record<string, unknown>) : {};
+    for (const userUUID of Object.keys(rawUsers)) {
+        users[userUUID] = pickPermissionMap(rawUsers[userUUID]);
+    }
+
+    return { roles, users };
+};

package/schemas/access-policy/index.ts

@@ -0,0 +1 @@
+export * from './access-policy.schema';

package/schemas/index.ts

@@ -67,3 +67,4 @@ export * from './messenger-profile';
 export * from './error-message.schema';
 export * from './account-deletion-request/account-deletion-request.schema';
 export * from './consignment-transfer';
+export * from './access-policy';