@flowerforce/flowerbase 1.8.4-beta.1 → 1.8.4-beta.2

package/dist/monitoring/utils.d.ts

@@ -77,7 +77,7 @@ export declare const getErrorDetails: (error: unknown) => {
 };
 export declare const pickHeaders: (headers: FastifyRequest["headers"]) => unknown;
 export declare const createEventStore: (maxAgeMs: number, maxEvents: number) => EventStore;
-export declare const classifyRequest: (url: string) => "function" | "auth" | "http_endpoint" | "trigger" | "api" | "http";
+export declare const classifyRequest: (url: string) => "function" | "api" | "auth" | "http_endpoint" | "trigger" | "http";
 export declare const createEventId: () => string;
 export declare const buildRulesMeta: (meta?: MonitMeta) => {
     collection: string;

package/dist/services/mongodb-atlas/index.js

@@ -490,7 +490,7 @@ const getOperators = (mongo, { rules, dbName, collName, user, run_as_system, mon
                         emitMongoEvent('findOne');
                         return null;
                     }
-                    const winningRole = (0, utils_2.getWinningRole)(result, user, roles);
+                    const winningRole = yield (0, utils_2.getWinningRoleAsync)(result, user, roles);
                     logDebug('findOne winningRole', {
                         collection: collName,
                         winningRoleName: (_a = winningRole === null || winningRole === void 0 ? void 0 : winningRole.name) !== null && _a !== void 0 ? _a : null,
@@ -546,7 +546,7 @@ const getOperators = (mongo, { rules, dbName, collName, user, run_as_system, mon
                     const formattedQuery = (0, utils_3.getFormattedQuery)(filters, query, user);
                     // Retrieve the document to check permissions before deleting
                     const result = yield collection.findOne(buildAndQuery(formattedQuery));
-                    const winningRole = (0, utils_2.getWinningRole)(result, user, roles);
+                    const winningRole = yield (0, utils_2.getWinningRoleAsync)(result, user, roles);
                     logDebug('delete winningRole', {
                         collection: collName,
                         userId: getUserId(user),
@@ -600,7 +600,7 @@ const getOperators = (mongo, { rules, dbName, collName, user, run_as_system, mon
             try {
                 if (!run_as_system) {
                     (0, utils_3.checkDenyOperation)(normalizedRules, collection.collectionName, model_1.CRUD_OPERATIONS.CREATE);
-                    const winningRole = (0, utils_2.getWinningRole)(data, user, roles);
+                    const winningRole = yield (0, utils_2.getWinningRoleAsync)(data, user, roles);
                     const { status, document } = winningRole
                         ? yield (0, machines_1.checkValidation)(winningRole, {
                             type: 'insert',
@@ -673,7 +673,7 @@ const getOperators = (mongo, { rules, dbName, collName, user, run_as_system, mon
                         }
                         throw new Error('Update not permitted');
                     }
-                    const winningRole = (0, utils_2.getWinningRole)(result, user, roles);
+                    const winningRole = yield (0, utils_2.getWinningRoleAsync)(result, user, roles);
                     // Check if the update data contains MongoDB update operators (e.g., $set, $inc)
                     const updatedPaths = getUpdatedPaths(normalizedData);
                     const docToCheck = applyDocumentUpdateOperators(result, normalizedData);
@@ -756,7 +756,7 @@ const getOperators = (mongo, { rules, dbName, collName, user, run_as_system, mon
                             : [applyDocumentUpdateOperators(currentDoc, normalizedData)];
                         docToCheck = computedDoc;
                     }
-                    const winningRole = (0, utils_2.getWinningRole)(docToCheck, user, roles);
+                    const winningRole = yield (0, utils_2.getWinningRoleAsync)(docToCheck, user, roles);
                     const { status, document } = winningRole
                         ? yield (0, machines_1.checkValidation)(winningRole, {
                             type: validationType,
@@ -776,7 +776,7 @@ const getOperators = (mongo, { rules, dbName, collName, user, run_as_system, mon
                         emitMongoEvent('findOneAndUpdate');
                         return updateResult;
                     }
-                    const readRole = (0, utils_2.getWinningRole)(updateResult, user, roles);
+                    const readRole = yield (0, utils_2.getWinningRoleAsync)(updateResult, user, roles);
                     const readResult = readRole
                         ? yield (0, machines_1.checkValidation)(readRole, {
                             type: 'read',
@@ -844,7 +844,7 @@ const getOperators = (mongo, { rules, dbName, collName, user, run_as_system, mon
                         const response = yield originalToArray();
                         const filteredResponse = yield Promise.all(response.map((currentDoc) => __awaiter(void 0, void 0, void 0, function* () {
                             var _a;
-                            const winningRole = (0, utils_2.getWinningRole)(currentDoc, user, roles);
+                            const winningRole = yield (0, utils_2.getWinningRoleAsync)(currentDoc, user, roles);
                             logDebug('find winningRole', {
                                 collection: collName,
                                 userId: getUserId(user),
@@ -976,7 +976,7 @@ const getOperators = (mongo, { rules, dbName, collName, user, run_as_system, mon
                     const isValidChange = (change) => __awaiter(void 0, void 0, void 0, function* () {
                         const { fullDocument, updateDescription } = change;
                         const hasFullDocument = !!fullDocument;
-                        const winningRole = (0, utils_2.getWinningRole)(fullDocument, user, roles);
+                        const winningRole = yield (0, utils_2.getWinningRoleAsync)(fullDocument, user, roles);
                         const fullDocumentValidation = winningRole
                             ? yield (0, machines_1.checkValidation)(winningRole, {
                                 type: 'read',
@@ -1088,7 +1088,7 @@ const getOperators = (mongo, { rules, dbName, collName, user, run_as_system, mon
                     (0, utils_3.checkDenyOperation)(normalizedRules, collection.collectionName, model_1.CRUD_OPERATIONS.CREATE);
                     // Validate each document against user's roles
                     const filteredItems = yield Promise.all(documents.map((currentDoc) => __awaiter(void 0, void 0, void 0, function* () {
-                        const winningRole = (0, utils_2.getWinningRole)(currentDoc, user, roles);
+                        const winningRole = yield (0, utils_2.getWinningRoleAsync)(currentDoc, user, roles);
                         const { status, document } = winningRole
                             ? yield (0, machines_1.checkValidation)(winningRole, {
                                 type: 'insert',
@@ -1133,7 +1133,7 @@ const getOperators = (mongo, { rules, dbName, collName, user, run_as_system, mon
                     const updatedPaths = getUpdatedPaths(normalizedData);
                     const docsToCheck = result.map((currentDoc) => applyDocumentUpdateOperators(currentDoc, normalizedData));
                     const filteredItems = yield Promise.all(docsToCheck.map((currentDoc, index) => __awaiter(void 0, void 0, void 0, function* () {
-                        const winningRole = (0, utils_2.getWinningRole)(currentDoc, user, roles);
+                        const winningRole = yield (0, utils_2.getWinningRoleAsync)(currentDoc, user, roles);
                         const { status, document } = winningRole
                             ? yield (0, machines_1.checkValidation)(winningRole, {
                                 type: 'write',
@@ -1187,7 +1187,7 @@ const getOperators = (mongo, { rules, dbName, collName, user, run_as_system, mon
                     const data = yield collection.find({ $and: formattedQuery }).toArray();
                     // Filter and validate each document based on user's roles
                     const filteredItems = yield Promise.all(data.map((currentDoc) => __awaiter(void 0, void 0, void 0, function* () {
-                        const winningRole = (0, utils_2.getWinningRole)(currentDoc, user, roles);
+                        const winningRole = yield (0, utils_2.getWinningRoleAsync)(currentDoc, user, roles);
                         const { status, document } = winningRole
                             ? yield (0, machines_1.checkValidation)(winningRole, {
                                 type: 'delete',

package/dist/utils/context/helpers.d.ts

@@ -35,11 +35,11 @@ export declare const generateContextData: ({ user, services, app, rules, current
         request: {
             remoteIPAddress: string | undefined;
             id?: string | undefined;
-            host?: string | undefined;
-            method?: string | undefined;
-            url?: string | undefined;
             ips?: string[];
+            host?: string | undefined;
             hostname?: string | undefined;
+            url?: string | undefined;
+            method?: string | undefined;
             ip?: string | undefined;
         };
         user: unknown;

package/dist/utils/roles/helpers.d.ts

@@ -1,4 +1,5 @@
 import { PermissionExpression } from './interface';
 import { MachineContext } from './machines/interface';
+export declare const evaluateExpandedExpression: (expression: unknown, params: MachineContext["params"], user?: MachineContext["user"]) => Promise<boolean>;
 export declare const evaluateExpression: (params: MachineContext["params"], expression?: PermissionExpression, user?: MachineContext["user"]) => Promise<boolean>;
 //# sourceMappingURL=helpers.d.ts.map

package/dist/utils/roles/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/utils/roles/helpers.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAkBrD,eAAO,MAAM,kBAAkB,GAC7B,QAAQ,cAAc,CAAC,QAAQ,CAAC,EAChC,aAAa,oBAAoB,EACjC,OAAO,cAAc,CAAC,MAAM,CAAC,KAC5B,OAAO,CAAC,OAAO,CAoBjB,CAAA"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/utils/roles/helpers.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AA+DrD,eAAO,MAAM,0BAA0B,GACrC,YAAY,OAAO,EACnB,QAAQ,cAAc,CAAC,QAAQ,CAAC,EAChC,OAAO,cAAc,CAAC,MAAM,CAAC,KAC5B,OAAO,CAAC,OAAO,CAwDjB,CAAA;AAED,eAAO,MAAM,kBAAkB,GAC7B,QAAQ,cAAc,CAAC,QAAQ,CAAC,EAChC,aAAa,oBAAoB,EACjC,OAAO,cAAc,CAAC,MAAM,CAAC,KAC5B,OAAO,CAAC,OAAO,CAMjB,CAAA"}

package/dist/utils/roles/helpers.js

@@ -12,13 +12,15 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.evaluateExpression = void 0;
+exports.evaluateExpression = exports.evaluateExpandedExpression = void 0;
 const services_1 = require("../../services");
 const state_1 = require("../../state");
 const context_1 = require("../context");
 const rules_1 = require("../rules");
 const utils_1 = __importDefault(require("../rules-matcher/utils"));
 const functionsConditions = ['%%true', '%%false'];
+const andConditions = ['$and', '%and'];
+const orConditions = ['$or', '%or'];
 const normalizeUserRole = (user) => {
     if (!user)
         return user;
@@ -34,17 +36,84 @@ const normalizeUserRole = (user) => {
         ? Object.assign(Object.assign({}, candidate), { role: customRole })
         : user;
 };
+const buildEvaluationContext = (params, user) => {
+    var _a, _b, _c;
+    const normalizedUser = normalizeUserRole(user);
+    return Object.assign(Object.assign(Object.assign({}, ((_a = params.expansions) !== null && _a !== void 0 ? _a : {})), ((_b = params.cursor) !== null && _b !== void 0 ? _b : {})), { '%%root': params.cursor, '%%prevRoot': (_c = params.expansions) === null || _c === void 0 ? void 0 : _c['%%prevRoot'], '%%user': normalizedUser, '%%true': true, '%%false': false });
+};
+const getFunctionCondition = (expression) => {
+    if (!expression || typeof expression !== 'object' || Array.isArray(expression)) {
+        return null;
+    }
+    const entries = Object.entries(expression);
+    if (entries.length !== 1) {
+        return null;
+    }
+    const [key, value] = entries[0];
+    if (!functionsConditions.includes(key)) {
+        return null;
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return null;
+    }
+    return Object.prototype.hasOwnProperty.call(value, '%function')
+        ? [key, value]
+        : null;
+};
+const evaluateExpandedExpression = (expression, params, user) => __awaiter(void 0, void 0, void 0, function* () {
+    if (typeof expression === 'boolean') {
+        return expression;
+    }
+    if (!expression || typeof expression !== 'object') {
+        return Boolean(expression);
+    }
+    const block = expression;
+    const functionCondition = getFunctionCondition(block);
+    if (functionCondition) {
+        return evaluateComplexExpression(functionCondition, params, user);
+    }
+    const andKey = andConditions.find((key) => Object.prototype.hasOwnProperty.call(block, key));
+    if (andKey) {
+        const conditions = Array.isArray(block[andKey]) ? block[andKey] : [];
+        if (!conditions.length)
+            return true;
+        for (const condition of conditions) {
+            if (!(yield (0, exports.evaluateExpandedExpression)(condition, params, user))) {
+                return false;
+            }
+        }
+        return true;
+    }
+    const orKey = orConditions.find((key) => Object.prototype.hasOwnProperty.call(block, key));
+    if (orKey) {
+        const conditions = Array.isArray(block[orKey]) ? block[orKey] : [];
+        if (!conditions.length)
+            return true;
+        for (const condition of conditions) {
+            if (yield (0, exports.evaluateExpandedExpression)(condition, params, user)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    const keys = Object.keys(block);
+    if (keys.length > 1) {
+        for (const key of keys) {
+            if (!(yield (0, exports.evaluateExpandedExpression)({ [key]: block[key] }, params, user))) {
+                return false;
+            }
+        }
+        return true;
+    }
+    return utils_1.default.checkRule(block, buildEvaluationContext(params, user), {});
+});
+exports.evaluateExpandedExpression = evaluateExpandedExpression;
 const evaluateExpression = (params, expression, user) => __awaiter(void 0, void 0, void 0, function* () {
-    var _a;
     if (!expression || typeof expression === 'boolean')
         return !!expression;
-    const normalizedUser = normalizeUserRole(user);
-    const value = Object.assign(Object.assign(Object.assign({}, params.expansions), params.cursor), { '%%root': params.cursor, '%%prevRoot': (_a = params.expansions) === null || _a === void 0 ? void 0 : _a['%%prevRoot'], '%%user': normalizedUser, '%%true': true, '%%false': false });
+    const value = buildEvaluationContext(params, user);
     const conditions = (0, rules_1.expandQuery)(expression, value);
-    const complexCondition = Object.entries(conditions).find(([key]) => functionsConditions.includes(key));
-    return complexCondition
-        ? yield evaluateComplexExpression(complexCondition, params, normalizedUser)
-        : utils_1.default.checkRule(conditions, value, {});
+    return (0, exports.evaluateExpandedExpression)(conditions, params, user);
 });
 exports.evaluateExpression = evaluateExpression;
 const evaluateComplexExpression = (condition, params, user) => __awaiter(void 0, void 0, void 0, function* () {

package/dist/utils/roles/machines/utils.d.ts

@@ -12,6 +12,7 @@ import { LogMachineInfoParams } from './interface';
  * @returns {Role | null} - Returns the first role that matches the `apply_when` condition, or `null` if none match.
  */
 export declare const getWinningRole: (document: OptionalId<Document> | null, user: User, roles?: Role[]) => Role | null;
+export declare const getWinningRoleAsync: (document: OptionalId<Document> | null, user: User, roles?: Role[]) => Promise<Role | null>;
 /**
  * Checks if the `apply_when` condition is valid for the given user and document.
  *
@@ -22,6 +23,7 @@ export declare const getWinningRole: (document: OptionalId<Document> | null, use
  * @returns {boolean} - Returns `true` if at least one valid rule is found, otherwise `false`.
  */
 export declare const checkApplyWhen: (apply_when: Role["apply_when"], user: User, document: OptionalId<Document> | null) => boolean;
+export declare const checkApplyWhenAsync: (apply_when: Role["apply_when"], user: User, document: OptionalId<Document> | null) => Promise<boolean>;
 /**
  * Logs machine step information if logging is enabled.
  *

package/dist/utils/roles/machines/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../../src/utils/roles/machines/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAGzC,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAElD;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GACzB,UAAU,UAAU,CAAC,QAAQ,CAAC,GAAG,IAAI,EACrC,MAAM,IAAI,EACV,QAAO,IAAI,EAAO,KACjB,IAAI,GAAG,IAQT,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GACzB,YAAY,IAAI,CAAC,YAAY,CAAC,EAC9B,MAAM,IAAI,EACV,UAAU,UAAU,CAAC,QAAQ,CAAC,GAAG,IAAI,YAQtC,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,cAAc,GAAI,sCAK5B,oBAAoB,SAEtB,CAAA"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../../src/utils/roles/machines/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAIzC,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAElD;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GACzB,UAAU,UAAU,CAAC,QAAQ,CAAC,GAAG,IAAI,EACrC,MAAM,IAAI,EACV,QAAO,IAAI,EAAO,KACjB,IAAI,GAAG,IAQT,CAAA;AAED,eAAO,MAAM,mBAAmB,GAC9B,UAAU,UAAU,CAAC,QAAQ,CAAC,GAAG,IAAI,EACrC,MAAM,IAAI,EACV,QAAO,IAAI,EAAO,KACjB,OAAO,CAAC,IAAI,GAAG,IAAI,CAQrB,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GACzB,YAAY,IAAI,CAAC,YAAY,CAAC,EAC9B,MAAM,IAAI,EACV,UAAU,UAAU,CAAC,QAAQ,CAAC,GAAG,IAAI,YAQtC,CAAA;AAED,eAAO,MAAM,mBAAmB,GAC9B,YAAY,IAAI,CAAC,YAAY,CAAC,EAC9B,MAAM,IAAI,EACV,UAAU,UAAU,CAAC,QAAQ,CAAC,GAAG,IAAI,qBActC,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,cAAc,GAAI,sCAK5B,oBAAoB,SAEtB,CAAA"}

package/dist/utils/roles/machines/utils.js

@@ -1,7 +1,17 @@
 "use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.logMachineInfo = exports.checkApplyWhen = exports.getWinningRole = void 0;
+exports.logMachineInfo = exports.checkApplyWhenAsync = exports.checkApplyWhen = exports.getWinningRoleAsync = exports.getWinningRole = void 0;
 const utils_1 = require("../../../services/mongodb-atlas/utils");
+const helpers_1 = require("../helpers");
 /**
  * Determines the first applicable role for a given user and document.
  *
@@ -22,6 +32,17 @@ const getWinningRole = (document, user, roles = []) => {
     return null;
 };
 exports.getWinningRole = getWinningRole;
+const getWinningRoleAsync = (document_1, user_1, ...args_1) => __awaiter(void 0, [document_1, user_1, ...args_1], void 0, function* (document, user, roles = []) {
+    if (!roles.length)
+        return null;
+    for (const role of roles) {
+        if (yield (0, exports.checkApplyWhenAsync)(role.apply_when, user, document)) {
+            return role;
+        }
+    }
+    return null;
+});
+exports.getWinningRoleAsync = getWinningRoleAsync;
 /**
  * Checks if the `apply_when` condition is valid for the given user and document.
  *
@@ -40,6 +61,17 @@ const checkApplyWhen = (apply_when, user, document) => {
     return !!validRule.length;
 };
 exports.checkApplyWhen = checkApplyWhen;
+const checkApplyWhenAsync = (apply_when, user, document) => __awaiter(void 0, void 0, void 0, function* () {
+    return (0, helpers_1.evaluateExpression)({
+        type: 'read',
+        roles: [],
+        cursor: document,
+        expansions: {
+            '%%prevRoot': undefined
+        }
+    }, apply_when, user);
+});
+exports.checkApplyWhenAsync = checkApplyWhenAsync;
 /**
  * Logs machine step information if logging is enabled.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowerforce/flowerbase",
-  "version": "1.8.4-beta.1",
+  "version": "1.8.4-beta.2",
   "description": "",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/services/mongodb-atlas/index.ts

@@ -19,7 +19,7 @@ import {
 import { Rules } from '../../features/rules/interface'
 import { buildRulesMeta } from '../../monitoring/utils'
 import { checkValidation } from '../../utils/roles/machines'
-import { getWinningRole } from '../../utils/roles/machines/utils'
+import { getWinningRoleAsync } from '../../utils/roles/machines/utils'
 import { emitServiceEvent } from '../monitoring'
 import { CHANGESTREAM } from '../../constants'
 import {
@@ -561,9 +561,9 @@ const getOperators: GetOperatorsFunction = (
         const resolvedOptions =
           projection || normalizedOptions
             ? {
-                ...(normalizedOptions ?? {}),
-                ...(projection ? { projection } : {})
-              }
+              ...(normalizedOptions ?? {}),
+              ...(projection ? { projection } : {})
+            }
             : undefined
         const resolvedQuery = query ?? {}
         if (!run_as_system) {
@@ -604,7 +604,7 @@ const getOperators: GetOperatorsFunction = (
             return null
           }
 
-          const winningRole = getWinningRole(result, user, roles)
+          const winningRole = await getWinningRoleAsync(result, user, roles)
 
           logDebug('findOne winningRole', {
             collection: collName,
@@ -613,15 +613,15 @@ const getOperators: GetOperatorsFunction = (
           })
           const { status, document } = winningRole
             ? await checkValidation(
-                winningRole,
-                {
-                  type: 'read',
-                  roles,
-                  cursor: result,
-                  expansions: getValidationExpansions(result)
-                },
-                user
-              )
+              winningRole,
+              {
+                type: 'read',
+                roles,
+                cursor: result,
+                expansions: getValidationExpansions(result)
+              },
+              user
+            )
             : fallbackAccess(result)
 
           // Return validated document or empty object if not permitted
@@ -669,7 +669,7 @@ const getOperators: GetOperatorsFunction = (
 
           // Retrieve the document to check permissions before deleting
           const result = await collection.findOne(buildAndQuery(formattedQuery))
-          const winningRole = getWinningRole(result, user, roles)
+          const winningRole = await getWinningRoleAsync(result, user, roles)
 
           logDebug('delete winningRole', {
             collection: collName,
@@ -678,15 +678,15 @@ const getOperators: GetOperatorsFunction = (
           })
           const { status } = winningRole
             ? await checkValidation(
-                winningRole,
-                {
-                  type: 'delete',
-                  roles,
-                  cursor: result,
-                  expansions: getValidationExpansions(result)
-                },
-                user
-              )
+              winningRole,
+              {
+                type: 'delete',
+                roles,
+                cursor: result,
+                expansions: getValidationExpansions(result)
+              },
+              user
+            )
             : fallbackAccess(result)
 
           if (!status) {
@@ -733,19 +733,19 @@ const getOperators: GetOperatorsFunction = (
             collection.collectionName,
             CRUD_OPERATIONS.CREATE
           )
-          const winningRole = getWinningRole(data, user, roles)
+          const winningRole = await getWinningRoleAsync(data, user, roles)
 
           const { status, document } = winningRole
             ? await checkValidation(
-                winningRole,
-                {
-                  type: 'insert',
-                  roles,
-                  cursor: data,
-                  expansions: getValidationExpansions()
-                },
-                user
-              )
+              winningRole,
+              {
+                type: 'insert',
+                roles,
+                cursor: data,
+                expansions: getValidationExpansions()
+              },
+              user
+            )
             : fallbackAccess(data)
 
           if (!status || !isEqual(data, document)) {
@@ -823,7 +823,7 @@ const getOperators: GetOperatorsFunction = (
             throw new Error('Update not permitted')
           }
 
-          const winningRole = getWinningRole(result, user, roles)
+          const winningRole = await getWinningRoleAsync(result, user, roles)
 
           // Check if the update data contains MongoDB update operators (e.g., $set, $inc)
           const updatedPaths = getUpdatedPaths(normalizedData)
@@ -831,15 +831,15 @@ const getOperators: GetOperatorsFunction = (
           // Validate update permissions
           const { status, document } = winningRole
             ? await checkValidation(
-                winningRole,
-                {
-                  type: 'write',
-                  roles,
-                  cursor: docToCheck,
-                  expansions: getValidationExpansions(result)
-                },
-                user
-              )
+              winningRole,
+              {
+                type: 'write',
+                roles,
+                cursor: docToCheck,
+                expansions: getValidationExpansions(result)
+              },
+              user
+            )
             : fallbackAccess(docToCheck)
           // Ensure no unauthorized changes are made
           const areDocumentsEqual = areUpdatedFieldsAllowed(
@@ -918,31 +918,31 @@ const getOperators: GetOperatorsFunction = (
           } else {
             const [computedDoc] = Array.isArray(normalizedData)
               ? await collection
-                  .aggregate([
-                    { $match: buildAndQuery(safeQuery) },
-                    { $limit: 1 },
-                    ...normalizedData
-                  ])
-                  .toArray()
+                .aggregate([
+                  { $match: buildAndQuery(safeQuery) },
+                  { $limit: 1 },
+                  ...normalizedData
+                ])
+                .toArray()
               : [applyDocumentUpdateOperators(currentDoc, normalizedData as Document)]
             docToCheck = computedDoc
           }
 
-          const winningRole = getWinningRole(docToCheck, user, roles)
+          const winningRole = await getWinningRoleAsync(docToCheck, user, roles)
 
           const { status, document } = winningRole
             ? await checkValidation(
-                winningRole,
-                {
-                  type: validationType,
-                  roles,
-                  cursor: docToCheck,
-                  expansions: getValidationExpansions(
-                    validationType === 'insert' ? undefined : currentDoc
-                  )
-                },
-                user
-              )
+              winningRole,
+              {
+                type: validationType,
+                roles,
+                cursor: docToCheck,
+                expansions: getValidationExpansions(
+                  validationType === 'insert' ? undefined : currentDoc
+                )
+              },
+              user
+            )
             : fallbackAccess(docToCheck)
 
           const areDocumentsEqual = areUpdatedFieldsAllowed(
@@ -956,28 +956,28 @@ const getOperators: GetOperatorsFunction = (
 
           const updateResult = normalizedOptions
             ? await collection.findOneAndUpdate(
-                buildAndQuery(safeQuery),
-                normalizedData,
-                normalizedOptions
-              )
+              buildAndQuery(safeQuery),
+              normalizedData,
+              normalizedOptions
+            )
             : await collection.findOneAndUpdate(buildAndQuery(safeQuery), normalizedData)
           if (!updateResult) {
             emitMongoEvent('findOneAndUpdate')
             return updateResult
           }
 
-          const readRole = getWinningRole(updateResult, user, roles)
+          const readRole = await getWinningRoleAsync(updateResult, user, roles)
           const readResult = readRole
             ? await checkValidation(
-                readRole,
-                {
-                  type: 'read',
-                  roles,
-                  cursor: updateResult,
-                  expansions: getValidationExpansions(updateResult)
-                },
-                user
-              )
+              readRole,
+              {
+                type: 'read',
+                roles,
+                cursor: updateResult,
+                expansions: getValidationExpansions(updateResult)
+              },
+              user
+            )
             : fallbackAccess(updateResult)
 
           const sanitizedDoc = readResult.status
@@ -1026,9 +1026,9 @@ const getOperators: GetOperatorsFunction = (
         const resolvedOptions =
           projection || normalizedOptions
             ? {
-                ...(normalizedOptions ?? {}),
-                ...(projection ? { projection } : {})
-              }
+              ...(normalizedOptions ?? {}),
+              ...(projection ? { projection } : {})
+            }
             : undefined
         if (!run_as_system) {
           checkDenyOperation(
@@ -1053,7 +1053,7 @@ const getOperators: GetOperatorsFunction = (
 
             const filteredResponse = await Promise.all(
               response.map(async (currentDoc) => {
-                const winningRole = getWinningRole(currentDoc, user, roles)
+                const winningRole = await getWinningRoleAsync(currentDoc, user, roles)
 
                 logDebug('find winningRole', {
                   collection: collName,
@@ -1063,15 +1063,15 @@ const getOperators: GetOperatorsFunction = (
                 })
                 const { status, document } = winningRole
                   ? await checkValidation(
-                      winningRole,
-                      {
-                        type: 'read',
-                        roles,
-                        cursor: currentDoc,
-                        expansions: getValidationExpansions(currentDoc)
-                      },
-                      user
-                    )
+                    winningRole,
+                    {
+                      type: 'read',
+                      roles,
+                      cursor: currentDoc,
+                      expansions: getValidationExpansions(currentDoc)
+                    },
+                    user
+                  )
                   : fallbackAccess(currentDoc)
 
                 return status ? document : undefined
@@ -1190,19 +1190,19 @@ const getOperators: GetOperatorsFunction = (
           const allowDeleteBypass = watchPipelineRequestsDelete(requestedPipeline)
           const firstStep = watchFormattedQuery.length
             ? {
-                $match: allowDeleteBypass
-                  ? {
-                      $or: [
-                        {
-                          $and: watchFormattedQuery
-                        },
-                        { operationType: 'delete' }
-                      ]
-                    }
-                  : {
+              $match: allowDeleteBypass
+                ? {
+                  $or: [
+                    {
                       $and: watchFormattedQuery
-                    }
-              }
+                    },
+                    { operationType: 'delete' }
+                  ]
+                }
+                : {
+                  $and: watchFormattedQuery
+                }
+            }
             : undefined
 
           const formattedPipeline = [firstStep, ...requestedPipeline].filter(
@@ -1221,33 +1221,33 @@ const getOperators: GetOperatorsFunction = (
           const isValidChange = async (change: Document) => {
             const { fullDocument, updateDescription } = change
             const hasFullDocument = !!fullDocument
-            const winningRole = getWinningRole(fullDocument, user, roles)
+            const winningRole = await getWinningRoleAsync(fullDocument, user, roles)
 
             const fullDocumentValidation = winningRole
               ? await checkValidation(
-                  winningRole,
-                  {
-                    type: 'read',
-                    roles,
-                    cursor: fullDocument,
-                    expansions: getValidationExpansions(fullDocument)
-                  },
-                  user
-                )
+                winningRole,
+                {
+                  type: 'read',
+                  roles,
+                  cursor: fullDocument,
+                  expansions: getValidationExpansions(fullDocument)
+                },
+                user
+              )
               : fallbackAccess(fullDocument)
             const { status, document } = fullDocumentValidation
 
             const { status: updatedFieldsStatus, document: updatedFields } = winningRole
               ? await checkValidation(
-                  winningRole,
-                  {
-                    type: 'read',
-                    roles,
-                    cursor: updateDescription?.updatedFields,
-                    expansions: getValidationExpansions(fullDocument)
-                  },
-                  user
-                )
+                winningRole,
+                {
+                  type: 'read',
+                  roles,
+                  cursor: updateDescription?.updatedFields,
+                  expansions: getValidationExpansions(fullDocument)
+                },
+                user
+              )
               : fallbackAccess(updateDescription?.updatedFields)
 
             return {
@@ -1389,19 +1389,19 @@ const getOperators: GetOperatorsFunction = (
           // Validate each document against user's roles
           const filteredItems = await Promise.all(
             documents.map(async (currentDoc) => {
-              const winningRole = getWinningRole(currentDoc, user, roles)
+              const winningRole = await getWinningRoleAsync(currentDoc, user, roles)
 
               const { status, document } = winningRole
                 ? await checkValidation(
-                    winningRole,
-                    {
-                      type: 'insert',
-                      roles,
-                      cursor: currentDoc,
-                      expansions: getValidationExpansions()
-                    },
-                    user
-                  )
+                  winningRole,
+                  {
+                    type: 'insert',
+                    roles,
+                    cursor: currentDoc,
+                    expansions: getValidationExpansions()
+                  },
+                  user
+                )
                 : fallbackAccess(currentDoc)
 
               return status ? document : undefined
@@ -1453,19 +1453,19 @@ const getOperators: GetOperatorsFunction = (
 
           const filteredItems = await Promise.all(
             docsToCheck.map(async (currentDoc, index) => {
-              const winningRole = getWinningRole(currentDoc, user, roles)
+              const winningRole = await getWinningRoleAsync(currentDoc, user, roles)
 
               const { status, document } = winningRole
                 ? await checkValidation(
-                    winningRole,
-                    {
-                      type: 'write',
-                      roles,
-                      cursor: currentDoc,
-                      expansions: getValidationExpansions(result[index])
-                    },
-                    user
-                  )
+                  winningRole,
+                  {
+                    type: 'write',
+                    roles,
+                    cursor: currentDoc,
+                    expansions: getValidationExpansions(result[index])
+                  },
+                  user
+                )
                 : fallbackAccess(currentDoc)
 
               return status ? document : undefined
@@ -1529,19 +1529,19 @@ const getOperators: GetOperatorsFunction = (
           // Filter and validate each document based on user's roles
           const filteredItems = await Promise.all(
             data.map(async (currentDoc) => {
-              const winningRole = getWinningRole(currentDoc, user, roles)
+              const winningRole = await getWinningRoleAsync(currentDoc, user, roles)
 
               const { status, document } = winningRole
                 ? await checkValidation(
-                    winningRole,
-                    {
-                      type: 'delete',
-                      roles,
-                      cursor: currentDoc,
-                      expansions: getValidationExpansions(currentDoc)
-                    },
-                    user
-                  )
+                  winningRole,
+                  {
+                    type: 'delete',
+                    roles,
+                    cursor: currentDoc,
+                    expansions: getValidationExpansions(currentDoc)
+                  },
+                  user
+                )
                 : fallbackAccess(currentDoc)
 
               return status ? document : undefined

package/src/utils/__tests__/evaluateExpression.test.ts

@@ -1,7 +1,48 @@
 import { evaluateExpression } from '../roles/helpers'
 import { Params } from '../roles/interface'
+import { GenerateContext } from '../context'
+import { StateManager } from '../../state'
+
+jest.mock('../context', () => ({
+  GenerateContext: jest.fn()
+}))
+
+jest.mock('../../state', () => ({
+  StateManager: {
+    select: jest.fn()
+  }
+}))
+
+jest.mock('../../services', () => ({
+  services: {}
+}))
+
+const mockedGenerateContext = jest.mocked(GenerateContext)
+const mockedSelect = jest.mocked(StateManager.select)
 
 describe('evaluateExpression', () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+    mockedSelect.mockImplementation(((key: string) => {
+      switch (key) {
+        case 'functions':
+          return {
+            checkAccess: {
+              name: 'checkAccess'
+            }
+          }
+        case 'app':
+          return {
+            id: 'app-id'
+          }
+        case 'rules':
+          return {}
+        default:
+          return undefined
+      }
+    }) as never)
+  })
+
   it('supports insert-only write expressions that rely on %%prevRoot', async () => {
     const expression = {
       '%%prevRoot': {
@@ -30,4 +71,52 @@ describe('evaluateExpression', () => {
     await expect(evaluateExpression(insertParams, expression)).resolves.toBe(true)
     await expect(evaluateExpression(readParams, expression)).resolves.toBe(false)
   })
+
+  it('supports nested %function conditions inside %or/%and expressions', async () => {
+    mockedGenerateContext.mockResolvedValue(true)
+
+    const expression = {
+      '%or': [
+        {
+          '%%root.company': 'company-1'
+        },
+        {
+          '%and': [
+            {
+              '%%user.custom_data.type': 'customer'
+            },
+            {
+              '%%true': {
+                '%function': {
+                  name: 'checkAccess',
+                  arguments: ['%%root.company']
+                }
+              }
+            }
+          ]
+        }
+      ]
+    }
+
+    const params = {
+      type: 'read',
+      cursor: { company: 'company-2' },
+      expansions: {},
+      roles: []
+    } as Params
+
+    const user = {
+      custom_data: {
+        type: 'customer'
+      }
+    }
+
+    await expect(evaluateExpression(params, expression, user as never)).resolves.toBe(true)
+    expect(mockedGenerateContext).toHaveBeenCalledWith(
+      expect.objectContaining({
+        args: ['company-2'],
+        functionName: 'checkAccess'
+      })
+    )
+  })
 })

package/src/utils/__tests__/getWinningRole.test.ts

@@ -70,4 +70,21 @@ describe('getWinningRole', () => {
     const result = getWinningRole(null, mockUser, mockRoles)
     expect(result).toEqual(mockRoles[0])
   })
+
+  it('should return the first matching role asynchronously', async () => {
+    const mockCheckApplyWhenAsync = jest
+      .spyOn(Utils, 'checkApplyWhenAsync')
+      .mockResolvedValueOnce(true)
+
+    await expect(Utils.getWinningRoleAsync(mockDocument, mockUser, mockRoles)).resolves.toEqual(
+      mockRoles[0]
+    )
+    expect(mockCheckApplyWhenAsync).toHaveBeenCalledWith(
+      mockRoles[0].apply_when,
+      mockUser,
+      mockDocument
+    )
+    expect(mockCheckApplyWhenAsync).toHaveBeenCalledTimes(1)
+    mockCheckApplyWhenAsync.mockReset()
+  })
 })

package/src/utils/roles/helpers.ts

@@ -7,6 +7,8 @@ import { PermissionExpression } from './interface'
 import { MachineContext } from './machines/interface'
 
 const functionsConditions = ['%%true', '%%false']
+const andConditions = ['$and', '%and']
+const orConditions = ['$or', '%or']
 
 const normalizeUserRole = (user?: MachineContext['user']) => {
   if (!user) return user
@@ -22,30 +24,121 @@ const normalizeUserRole = (user?: MachineContext['user']) => {
     : user
 }
 
-export const evaluateExpression = async (
+const buildEvaluationContext = (
   params: MachineContext['params'],
-  expression?: PermissionExpression,
   user?: MachineContext['user']
-): Promise<boolean> => {
-  if (!expression || typeof expression === 'boolean') return !!expression
+) => {
   const normalizedUser = normalizeUserRole(user)
 
-  const value = {
-    ...params.expansions,
-    ...params.cursor,
+  return {
+    ...(params.expansions ?? {}),
+    ...(params.cursor ?? {}),
     '%%root': params.cursor,
     '%%prevRoot': params.expansions?.['%%prevRoot'],
     '%%user': normalizedUser,
     '%%true': true,
     '%%false': false
   }
+}
+
+const getFunctionCondition = (
+  expression: unknown
+): [string, Record<string, any>] | null => {
+  if (!expression || typeof expression !== 'object' || Array.isArray(expression)) {
+    return null
+  }
+
+  const entries = Object.entries(expression as Record<string, unknown>)
+  if (entries.length !== 1) {
+    return null
+  }
+
+  const [key, value] = entries[0]
+  if (!functionsConditions.includes(key)) {
+    return null
+  }
+
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return null
+  }
+
+  return Object.prototype.hasOwnProperty.call(value, '%function')
+    ? [key, value as Record<string, any>]
+    : null
+}
+
+export const evaluateExpandedExpression = async (
+  expression: unknown,
+  params: MachineContext['params'],
+  user?: MachineContext['user']
+): Promise<boolean> => {
+  if (typeof expression === 'boolean') {
+    return expression
+  }
+
+  if (!expression || typeof expression !== 'object') {
+    return Boolean(expression)
+  }
+
+  const block = expression as Record<string, unknown>
+  const functionCondition = getFunctionCondition(block)
+
+  if (functionCondition) {
+    return evaluateComplexExpression(functionCondition, params, user)
+  }
+
+  const andKey = andConditions.find((key) => Object.prototype.hasOwnProperty.call(block, key))
+  if (andKey) {
+    const conditions = Array.isArray(block[andKey]) ? (block[andKey] as unknown[]) : []
+    if (!conditions.length) return true
+
+    for (const condition of conditions) {
+      if (!(await evaluateExpandedExpression(condition, params, user))) {
+        return false
+      }
+    }
+
+    return true
+  }
+
+  const orKey = orConditions.find((key) => Object.prototype.hasOwnProperty.call(block, key))
+  if (orKey) {
+    const conditions = Array.isArray(block[orKey]) ? (block[orKey] as unknown[]) : []
+    if (!conditions.length) return true
+
+    for (const condition of conditions) {
+      if (await evaluateExpandedExpression(condition, params, user)) {
+        return true
+      }
+    }
+
+    return false
+  }
+
+  const keys = Object.keys(block)
+  if (keys.length > 1) {
+    for (const key of keys) {
+      if (!(await evaluateExpandedExpression({ [key]: block[key] }, params, user))) {
+        return false
+      }
+    }
+
+    return true
+  }
+
+  return rulesMatcherUtils.checkRule(block as never, buildEvaluationContext(params, user), {})
+}
+
+export const evaluateExpression = async (
+  params: MachineContext['params'],
+  expression?: PermissionExpression,
+  user?: MachineContext['user']
+): Promise<boolean> => {
+  if (!expression || typeof expression === 'boolean') return !!expression
+
+  const value = buildEvaluationContext(params, user)
   const conditions = expandQuery(expression, value)
-  const complexCondition = Object.entries(conditions as Record<string, any>).find(
-    ([key]) => functionsConditions.includes(key)
-  )
-  return complexCondition
-    ? await evaluateComplexExpression(complexCondition, params, normalizedUser)
-    : rulesMatcherUtils.checkRule(conditions, value, {})
+  return evaluateExpandedExpression(conditions, params, user)
 }
 
 const evaluateComplexExpression = async (
@@ -74,7 +167,7 @@ const evaluateComplexExpression = async (
   const expandedArguments =
     fnArguments && fnArguments.length
       ? ((expandQuery({ args: fnArguments }, expansionContext) as { args: unknown[] })
-          .args ?? [])
+        .args ?? [])
       : [params.cursor]
 
   const response = await GenerateContext({

package/src/utils/roles/machines/utils.ts

@@ -2,6 +2,7 @@ import { Document, OptionalId } from 'mongodb'
 import { User } from '../../../auth/dtos'
 import { Filter } from '../../../features/rules/interface'
 import { getValidRule } from '../../../services/mongodb-atlas/utils'
+import { evaluateExpression } from '../helpers'
 import { Role } from '../interface'
 import { LogMachineInfoParams } from './interface'
 
@@ -28,6 +29,20 @@ export const getWinningRole = (
   return null
 }
 
+export const getWinningRoleAsync = async (
+  document: OptionalId<Document> | null,
+  user: User,
+  roles: Role[] = []
+): Promise<Role | null> => {
+  if (!roles.length) return null
+  for (const role of roles) {
+    if (await checkApplyWhenAsync(role.apply_when, user, document)) {
+      return role
+    }
+  }
+  return null
+}
+
 /**
  * Checks if the `apply_when` condition is valid for the given user and document.
  *
@@ -50,6 +65,25 @@ export const checkApplyWhen = (
   return !!validRule.length
 }
 
+export const checkApplyWhenAsync = async (
+  apply_when: Role['apply_when'],
+  user: User,
+  document: OptionalId<Document> | null
+) => {
+  return evaluateExpression(
+    {
+      type: 'read',
+      roles: [],
+      cursor: document,
+      expansions: {
+        '%%prevRoot': undefined
+      }
+    },
+    apply_when,
+    user
+  )
+}
+
 /**
  * Logs machine step information if logging is enabled.
  *