@flusys/nestjs-shared 7.0.2 → 8.0.0-beta.1

package/cjs/guards/optional-jwt-auth.guard.js

@@ -1,67 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "OptionalJwtGuard", {
-    enumerable: true,
-    get: function() {
-        return OptionalJwtGuard;
-    }
-});
-const _common = require("@nestjs/common");
-const _core = require("@nestjs/core");
-const _passport = require("@nestjs/passport");
-const _constants = require("../constants");
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-let OptionalJwtGuard = class OptionalJwtGuard extends (0, _passport.AuthGuard)('jwt') {
-    canActivate(context) {
-        const isPublic = this.reflector.getAllAndOverride(_constants.IS_PUBLIC_KEY, [
-            context.getHandler(),
-            context.getClass()
-        ]);
-        if (isPublic) {
-            return true;
-        }
-        return super.canActivate(context);
-    }
-    handleRequest(_err, user) {
-        return user || undefined;
-    }
-    constructor(reflector){
-        super(), _define_property(this, "reflector", void 0), this.reflector = reflector;
-    }
-};
-OptionalJwtGuard = _ts_decorate([
-    (0, _common.Injectable)(),
-    _ts_param(0, (0, _common.Inject)(_core.Reflector)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof _core.Reflector === "undefined" ? Object : _core.Reflector
-    ])
-], OptionalJwtGuard);

package/cjs/guards/optional-jwt-auth.guard.spec.js

@@ -1,55 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-const _core = require("@nestjs/core");
-const _passport = require("@nestjs/passport");
-const _optionaljwtauthguard = require("./optional-jwt-auth.guard");
-function buildContext() {
-    return {
-        getHandler: ()=>({}),
-        getClass: ()=>({})
-    };
-}
-describe('OptionalJwtGuard', ()=>{
-    let reflector;
-    let guard;
-    let superCanActivateSpy;
-    beforeEach(()=>{
-        reflector = new _core.Reflector();
-        guard = new _optionaljwtauthguard.OptionalJwtGuard(reflector);
-        superCanActivateSpy = jest.spyOn((0, _passport.AuthGuard)('jwt').prototype, 'canActivate').mockReturnValue(true);
-    });
-    afterEach(()=>{
-        jest.restoreAllMocks();
-    });
-    describe('canActivate', ()=>{
-        it('should allow access without invoking the parent guard when the route is public', ()=>{
-            jest.spyOn(reflector, 'getAllAndOverride').mockReturnValue(true);
-            expect(guard.canActivate(buildContext())).toBe(true);
-            expect(superCanActivateSpy).not.toHaveBeenCalled();
-        });
-        it('should delegate to the parent AuthGuard when the route is not public', ()=>{
-            jest.spyOn(reflector, 'getAllAndOverride').mockReturnValue(false);
-            expect(guard.canActivate(buildContext())).toBe(true);
-            expect(superCanActivateSpy).toHaveBeenCalled();
-        });
-    });
-    describe('handleRequest', ()=>{
-        it('should return the user when present', ()=>{
-            const user = {
-                id: 'user-1'
-            };
-            expect(guard.handleRequest(null, user)).toBe(user);
-        });
-        it('should return undefined (not throw) when there is an error', ()=>{
-            expect(guard.handleRequest(new Error('token expired'), null)).toBeUndefined();
-        });
-        it('should return undefined when there is no user and no error', ()=>{
-            expect(guard.handleRequest(null, null)).toBeUndefined();
-        });
-        it('should return undefined for a falsy user value', ()=>{
-            expect(guard.handleRequest(null, false)).toBeUndefined();
-        });
-    });
-});

package/cjs/guards/permission.guard.js

@@ -1,179 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "PermissionGuard", {
-    enumerable: true,
-    get: function() {
-        return PermissionGuard;
-    }
-});
-const _common = require("@nestjs/common");
-const _core = require("@nestjs/core");
-const _constants = require("../constants");
-const _permissionexception = require("../exceptions/permission.exception");
-const _sharedpermissioncacheservice = require("../modules/shared-permission-cache/shared-permission-cache.service");
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-let PermissionGuard = class PermissionGuard {
-    async canActivate(context) {
-        const isPublic = this.reflector.getAllAndOverride(_constants.IS_PUBLIC_KEY, [
-            context.getHandler(),
-            context.getClass()
-        ]);
-        if (isPublic) return true;
-        const permissionConfig = this.reflector.getAllAndOverride(_constants.PERMISSIONS_KEY, [
-            context.getHandler(),
-            context.getClass()
-        ]);
-        if (!permissionConfig) return true;
-        const request = context.switchToHttp().getRequest();
-        const user = request.user;
-        if (!user) throw new _common.UnauthorizedException({
-            message: 'Authentication required',
-            messageKey: _constants.AUTH_MESSAGES.TOKEN_REQUIRED
-        });
-        if (!this.permissionCacheService?.isCacheConfigured()) {
-            throw new _permissionexception.PermissionSystemUnavailableException();
-        }
-        const permissionService = this.permissionCacheService;
-        const userPermissions = await permissionService.getPermissions({
-            userId: user.id,
-            companyId: user.companyId,
-            branchId: user.branchId
-        });
-        if (!userPermissions || userPermissions.length === 0) {
-            throw new _permissionexception.NoPermissionsFoundException();
-        }
-        const logicNode = this.normalizeToLogicNode(permissionConfig);
-        if (!logicNode) return true;
-        const result = this.evaluateLogicNode(logicNode, userPermissions, permissionService);
-        if (!result.passed) {
-            throw new _permissionexception.InsufficientPermissionsException(result.missingPermissions, result.operator);
-        }
-        return true;
-    }
-    normalizeToLogicNode(config) {
-        // string - single permission
-        if (typeof config === 'string') {
-            return config ? {
-                type: 'action',
-                actionId: config
-            } : null;
-        }
-        // string[] - treat as AND of multiple permissions
-        if (Array.isArray(config)) {
-            if (config.length === 0) return null;
-            if (config.length === 1) return {
-                type: 'action',
-                actionId: config[0]
-            };
-            return {
-                type: 'group',
-                operator: 'AND',
-                children: config.map((p)=>({
-                        type: 'action',
-                        actionId: p
-                    }))
-            };
-        }
-        // SimplePermissionConfig - { permissions: string[], operator: 'AND'|'OR' }
-        if ('permissions' in config && Array.isArray(config.permissions)) {
-            const simple = config;
-            if (simple.permissions.length === 0) return null;
-            if (simple.permissions.length === 1) return {
-                type: 'action',
-                actionId: simple.permissions[0]
-            };
-            return {
-                type: 'group',
-                operator: simple.operator || 'AND',
-                children: simple.permissions.map((p)=>({
-                        type: 'action',
-                        actionId: p
-                    }))
-            };
-        }
-        // ILogicNode
-        return config;
-    }
-    evaluateLogicNode(node, userPermissions, permissionService) {
-        if (node.type === 'action') {
-            const passed = permissionService.matchPermission(userPermissions, node.actionId);
-            return {
-                passed,
-                missingPermissions: passed ? [] : [
-                    node.actionId
-                ],
-                operator: 'AND'
-            };
-        }
-        // Group node
-        const { operator, children } = node;
-        // SECURITY: Fail-closed - deny access when no children configured
-        if (!children || children.length === 0) {
-            return {
-                passed: false,
-                missingPermissions: [],
-                operator
-            };
-        }
-        const results = [];
-        const missingPermissions = [];
-        for (const child of children){
-            const childResult = this.evaluateLogicNode(child, userPermissions, permissionService);
-            results.push(childResult.passed);
-            if (!childResult.passed) {
-                missingPermissions.push(...childResult.missingPermissions);
-            }
-        }
-        const passed = operator === 'OR' ? results.some((r)=>r) : results.every((r)=>r);
-        return {
-            passed,
-            missingPermissions: passed ? [] : missingPermissions,
-            operator
-        };
-    }
-    constructor(reflector, permissionCacheService){
-        _define_property(this, "reflector", void 0);
-        _define_property(this, "permissionCacheService", void 0);
-        this.reflector = reflector;
-        this.permissionCacheService = permissionCacheService;
-    }
-};
-PermissionGuard = _ts_decorate([
-    (0, _common.Injectable)(),
-    _ts_param(0, (0, _common.Inject)(_core.Reflector)),
-    _ts_param(1, (0, _common.Optional)()),
-    _ts_param(1, (0, _common.Inject)(_sharedpermissioncacheservice.SharedPermissionCacheService)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof _core.Reflector === "undefined" ? Object : _core.Reflector,
-        typeof _sharedpermissioncacheservice.SharedPermissionCacheService === "undefined" ? Object : _sharedpermissioncacheservice.SharedPermissionCacheService
-    ])
-], PermissionGuard);

package/cjs/guards/permission.guard.spec.js

@@ -1,373 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-const _common = require("@nestjs/common");
-const _core = require("@nestjs/core");
-const _constants = require("../constants");
-const _permissionexception = require("../exceptions/permission.exception");
-const _sharedpermissioncacheservice = require("../modules/shared-permission-cache/shared-permission-cache.service");
-const _permissionguard = require("./permission.guard");
-function buildContext(request) {
-    return {
-        getHandler: ()=>({}),
-        getClass: ()=>({}),
-        switchToHttp: ()=>({
-                getRequest: ()=>request
-            })
-    };
-}
-function buildPermissionService(cache, config) {
-    return new _sharedpermissioncacheservice.SharedPermissionCacheService(cache, config);
-}
-describe('PermissionGuard', ()=>{
-    let reflector;
-    let cache;
-    let permissionCacheService;
-    let getAllAndOverrideMock;
-    beforeEach(()=>{
-        reflector = new _core.Reflector();
-        cache = {
-            get: jest.fn(),
-            set: jest.fn(),
-            del: jest.fn()
-        };
-        permissionCacheService = buildPermissionService(cache);
-        getAllAndOverrideMock = jest.fn();
-        jest.spyOn(reflector, 'getAllAndOverride').mockImplementation(getAllAndOverrideMock);
-    });
-    function mockMetadata(isPublic, permissionConfig) {
-        getAllAndOverrideMock.mockImplementation((key)=>{
-            if (key === _constants.IS_PUBLIC_KEY) return isPublic;
-            if (key === _constants.PERMISSIONS_KEY) return permissionConfig;
-            return undefined;
-        });
-    }
-    describe('public routes and missing permission metadata', ()=>{
-        it('should allow access when the route is public', async ()=>{
-            mockMetadata(true, undefined);
-            const guard = new _permissionguard.PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({}))).resolves.toBe(true);
-        });
-        it('should allow access when no permission metadata is set', async ()=>{
-            mockMetadata(false, undefined);
-            const guard = new _permissionguard.PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).resolves.toBe(true);
-        });
-    });
-    describe('authentication requirement', ()=>{
-        it('should throw UnauthorizedException when there is no user on the request', async ()=>{
-            mockMetadata(false, 'user.read');
-            const guard = new _permissionguard.PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({}))).rejects.toMatchObject({
-                constructor: _common.UnauthorizedException
-            });
-            try {
-                await guard.canActivate(buildContext({}));
-            } catch (error) {
-                expect(error.getResponse()).toMatchObject({
-                    messageKey: _constants.AUTH_MESSAGES.TOKEN_REQUIRED
-                });
-            }
-        });
-    });
-    describe('cache availability', ()=>{
-        it('should throw PermissionSystemUnavailableException when no cache is injected', async ()=>{
-            mockMetadata(false, 'user.read');
-            const guard = new _permissionguard.PermissionGuard(reflector, buildPermissionService(undefined));
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).rejects.toBeInstanceOf(_permissionexception.PermissionSystemUnavailableException);
-        });
-        it('should throw PermissionSystemUnavailableException when no permission service is injected', async ()=>{
-            mockMetadata(false, 'user.read');
-            const guard = new _permissionguard.PermissionGuard(reflector, undefined);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).rejects.toBeInstanceOf(_permissionexception.PermissionSystemUnavailableException);
-        });
-    });
-    describe('permission resolution', ()=>{
-        it('should throw NoPermissionsFoundException when the user has no cached permissions', async ()=>{
-            mockMetadata(false, 'user.read');
-            cache.get.mockResolvedValue(undefined);
-            const guard = new _permissionguard.PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).rejects.toBeInstanceOf(_permissionexception.NoPermissionsFoundException);
-        });
-        it('should throw NoPermissionsFoundException when the cached permission array is empty', async ()=>{
-            mockMetadata(false, 'user.read');
-            cache.get.mockResolvedValue([]);
-            const guard = new _permissionguard.PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).rejects.toBeInstanceOf(_permissionexception.NoPermissionsFoundException);
-        });
-        it('should allow access for a single string permission that the user has', async ()=>{
-            mockMetadata(false, 'user.read');
-            cache.get.mockResolvedValue([
-                'user.read'
-            ]);
-            const guard = new _permissionguard.PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).resolves.toBe(true);
-        });
-        it('should throw InsufficientPermissionsException for a single string permission the user lacks', async ()=>{
-            mockMetadata(false, 'user.write');
-            cache.get.mockResolvedValue([
-                'user.read'
-            ]);
-            const guard = new _permissionguard.PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).rejects.toBeInstanceOf(_permissionexception.InsufficientPermissionsException);
-        });
-        it('should support a wildcard "*" permission granting everything', async ()=>{
-            mockMetadata(false, 'anything.here');
-            cache.get.mockResolvedValue([
-                '*'
-            ]);
-            const guard = new _permissionguard.PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).resolves.toBe(true);
-        });
-        it('should support a namespaced wildcard like "user.*"', async ()=>{
-            mockMetadata(false, 'user.delete');
-            cache.get.mockResolvedValue([
-                'user.*'
-            ]);
-            const guard = new _permissionguard.PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).resolves.toBe(true);
-        });
-        it('should evaluate an array of permissions as AND logic', async ()=>{
-            mockMetadata(false, [
-                'user.read',
-                'user.write'
-            ]);
-            cache.get.mockResolvedValue([
-                'user.read'
-            ]);
-            const guard = new _permissionguard.PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).rejects.toBeInstanceOf(_permissionexception.InsufficientPermissionsException);
-        });
-        it('should pass an array of permissions when the user has all of them', async ()=>{
-            mockMetadata(false, [
-                'user.read',
-                'user.write'
-            ]);
-            cache.get.mockResolvedValue([
-                'user.read',
-                'user.write'
-            ]);
-            const guard = new _permissionguard.PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).resolves.toBe(true);
-        });
-        it('should return true for an empty permission array (no-op logic node)', async ()=>{
-            mockMetadata(false, []);
-            cache.get.mockResolvedValue([
-                'user.read'
-            ]);
-            const guard = new _permissionguard.PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).resolves.toBe(true);
-        });
-        it('should evaluate SimplePermissionConfig with OR operator', async ()=>{
-            mockMetadata(false, {
-                permissions: [
-                    'admin',
-                    'manager'
-                ],
-                operator: 'OR'
-            });
-            cache.get.mockResolvedValue([
-                'manager'
-            ]);
-            const guard = new _permissionguard.PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).resolves.toBe(true);
-        });
-        it('should reject SimplePermissionConfig with OR operator when none match', async ()=>{
-            mockMetadata(false, {
-                permissions: [
-                    'admin',
-                    'manager'
-                ],
-                operator: 'OR'
-            });
-            cache.get.mockResolvedValue([
-                'guest'
-            ]);
-            const guard = new _permissionguard.PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).rejects.toBeInstanceOf(_permissionexception.InsufficientPermissionsException);
-        });
-        it('should return true for SimplePermissionConfig with an empty permissions array', async ()=>{
-            mockMetadata(false, {
-                permissions: [],
-                operator: 'AND'
-            });
-            cache.get.mockResolvedValue([
-                'user.read'
-            ]);
-            const guard = new _permissionguard.PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).resolves.toBe(true);
-        });
-        it('should evaluate a nested ILogicNode tree (AND of action + OR group)', async ()=>{
-            mockMetadata(false, {
-                type: 'group',
-                operator: 'AND',
-                children: [
-                    {
-                        type: 'action',
-                        actionId: 'users.read'
-                    },
-                    {
-                        type: 'group',
-                        operator: 'OR',
-                        children: [
-                            {
-                                type: 'action',
-                                actionId: 'admin'
-                            },
-                            {
-                                type: 'action',
-                                actionId: 'manager'
-                            }
-                        ]
-                    }
-                ]
-            });
-            cache.get.mockResolvedValue([
-                'users.read',
-                'manager'
-            ]);
-            const guard = new _permissionguard.PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).resolves.toBe(true);
-        });
-        it('should fail-closed on a group node with no children', async ()=>{
-            mockMetadata(false, {
-                type: 'group',
-                operator: 'AND',
-                children: []
-            });
-            cache.get.mockResolvedValue([
-                'user.read'
-            ]);
-            const guard = new _permissionguard.PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).rejects.toBeInstanceOf(_permissionexception.InsufficientPermissionsException);
-        });
-        it('should read backendCodes from an object-shaped cache value', async ()=>{
-            mockMetadata(false, 'user.read');
-            cache.get.mockResolvedValue({
-                backendCodes: [
-                    'user.read'
-                ]
-            });
-            const guard = new _permissionguard.PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).resolves.toBe(true);
-        });
-        it('should treat an object-shaped cache value with no backendCodes as no permissions', async ()=>{
-            mockMetadata(false, 'user.read');
-            cache.get.mockResolvedValue({});
-            const guard = new _permissionguard.PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).rejects.toBeInstanceOf(_permissionexception.NoPermissionsFoundException);
-        });
-    });
-    describe('company-scoped cache key', ()=>{
-        it('should include companyId/branchId in the cache lookup when company feature is enabled', async ()=>{
-            mockMetadata(false, 'user.read');
-            cache.get.mockResolvedValue([
-                'user.read'
-            ]);
-            const guard = new _permissionguard.PermissionGuard(reflector, buildPermissionService(cache, {
-                enableCompanyFeature: true
-            }));
-            await guard.canActivate(buildContext({
-                user: {
-                    id: 'u1',
-                    companyId: 'c1',
-                    branchId: 'b1'
-                }
-            }));
-            expect(cache.get).toHaveBeenCalledWith(expect.stringContaining('company:c1:branch:b1:user:u1'));
-        });
-        it('should fall back to the user-scoped cache key when company feature is disabled', async ()=>{
-            mockMetadata(false, 'user.read');
-            cache.get.mockResolvedValue([
-                'user.read'
-            ]);
-            const guard = new _permissionguard.PermissionGuard(reflector, permissionCacheService);
-            await guard.canActivate(buildContext({
-                user: {
-                    id: 'u1',
-                    companyId: 'c1',
-                    branchId: 'b1'
-                }
-            }));
-            expect(cache.get).toHaveBeenCalledWith(expect.stringContaining(':user:u1'));
-            expect(cache.get).toHaveBeenCalledWith(expect.not.stringContaining('company'));
-        });
-    });
-});