@flusys/nestjs-shared 7.1.0 → 8.0.0

package/fesm/guards/permission.guard.js

@@ -1,169 +0,0 @@
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-import { Inject, Injectable, Optional, UnauthorizedException } from '@nestjs/common';
-import { Reflector } from '@nestjs/core';
-import { AUTH_MESSAGES, IS_PUBLIC_KEY, PERMISSIONS_KEY } from '../constants';
-import { InsufficientPermissionsException, NoPermissionsFoundException, PermissionSystemUnavailableException } from '../exceptions/permission.exception';
-import { SharedPermissionCacheService } from '../modules/shared-permission-cache/shared-permission-cache.service';
-export class PermissionGuard {
-    async canActivate(context) {
-        const isPublic = this.reflector.getAllAndOverride(IS_PUBLIC_KEY, [
-            context.getHandler(),
-            context.getClass()
-        ]);
-        if (isPublic) return true;
-        const permissionConfig = this.reflector.getAllAndOverride(PERMISSIONS_KEY, [
-            context.getHandler(),
-            context.getClass()
-        ]);
-        if (!permissionConfig) return true;
-        const request = context.switchToHttp().getRequest();
-        const user = request.user;
-        if (!user) throw new UnauthorizedException({
-            message: 'Authentication required',
-            messageKey: AUTH_MESSAGES.TOKEN_REQUIRED
-        });
-        if (!this.permissionCacheService?.isCacheConfigured()) {
-            throw new PermissionSystemUnavailableException();
-        }
-        const permissionService = this.permissionCacheService;
-        const userPermissions = await permissionService.getPermissions({
-            userId: user.id,
-            companyId: user.companyId,
-            branchId: user.branchId
-        });
-        if (!userPermissions || userPermissions.length === 0) {
-            throw new NoPermissionsFoundException();
-        }
-        const logicNode = this.normalizeToLogicNode(permissionConfig);
-        if (!logicNode) return true;
-        const result = this.evaluateLogicNode(logicNode, userPermissions, permissionService);
-        if (!result.passed) {
-            throw new InsufficientPermissionsException(result.missingPermissions, result.operator);
-        }
-        return true;
-    }
-    normalizeToLogicNode(config) {
-        // string - single permission
-        if (typeof config === 'string') {
-            return config ? {
-                type: 'action',
-                actionId: config
-            } : null;
-        }
-        // string[] - treat as AND of multiple permissions
-        if (Array.isArray(config)) {
-            if (config.length === 0) return null;
-            if (config.length === 1) return {
-                type: 'action',
-                actionId: config[0]
-            };
-            return {
-                type: 'group',
-                operator: 'AND',
-                children: config.map((p)=>({
-                        type: 'action',
-                        actionId: p
-                    }))
-            };
-        }
-        // SimplePermissionConfig - { permissions: string[], operator: 'AND'|'OR' }
-        if ('permissions' in config && Array.isArray(config.permissions)) {
-            const simple = config;
-            if (simple.permissions.length === 0) return null;
-            if (simple.permissions.length === 1) return {
-                type: 'action',
-                actionId: simple.permissions[0]
-            };
-            return {
-                type: 'group',
-                operator: simple.operator || 'AND',
-                children: simple.permissions.map((p)=>({
-                        type: 'action',
-                        actionId: p
-                    }))
-            };
-        }
-        // ILogicNode
-        return config;
-    }
-    evaluateLogicNode(node, userPermissions, permissionService) {
-        if (node.type === 'action') {
-            const passed = permissionService.matchPermission(userPermissions, node.actionId);
-            return {
-                passed,
-                missingPermissions: passed ? [] : [
-                    node.actionId
-                ],
-                operator: 'AND'
-            };
-        }
-        // Group node
-        const { operator, children } = node;
-        // SECURITY: Fail-closed - deny access when no children configured
-        if (!children || children.length === 0) {
-            return {
-                passed: false,
-                missingPermissions: [],
-                operator
-            };
-        }
-        const results = [];
-        const missingPermissions = [];
-        for (const child of children){
-            const childResult = this.evaluateLogicNode(child, userPermissions, permissionService);
-            results.push(childResult.passed);
-            if (!childResult.passed) {
-                missingPermissions.push(...childResult.missingPermissions);
-            }
-        }
-        const passed = operator === 'OR' ? results.some((r)=>r) : results.every((r)=>r);
-        return {
-            passed,
-            missingPermissions: passed ? [] : missingPermissions,
-            operator
-        };
-    }
-    constructor(reflector, permissionCacheService){
-        _define_property(this, "reflector", void 0);
-        _define_property(this, "permissionCacheService", void 0);
-        this.reflector = reflector;
-        this.permissionCacheService = permissionCacheService;
-    }
-}
-PermissionGuard = _ts_decorate([
-    Injectable(),
-    _ts_param(0, Inject(Reflector)),
-    _ts_param(1, Optional()),
-    _ts_param(1, Inject(SharedPermissionCacheService)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof Reflector === "undefined" ? Object : Reflector,
-        typeof SharedPermissionCacheService === "undefined" ? Object : SharedPermissionCacheService
-    ])
-], PermissionGuard);

package/fesm/guards/permission.guard.spec.js

@@ -1,369 +0,0 @@
-import { UnauthorizedException } from '@nestjs/common';
-import { Reflector } from '@nestjs/core';
-import { AUTH_MESSAGES, IS_PUBLIC_KEY, PERMISSIONS_KEY } from '../constants';
-import { InsufficientPermissionsException, NoPermissionsFoundException, PermissionSystemUnavailableException } from '../exceptions/permission.exception';
-import { SharedPermissionCacheService } from '../modules/shared-permission-cache/shared-permission-cache.service';
-import { PermissionGuard } from './permission.guard';
-function buildContext(request) {
-    return {
-        getHandler: ()=>({}),
-        getClass: ()=>({}),
-        switchToHttp: ()=>({
-                getRequest: ()=>request
-            })
-    };
-}
-function buildPermissionService(cache, config) {
-    return new SharedPermissionCacheService(cache, config);
-}
-describe('PermissionGuard', ()=>{
-    let reflector;
-    let cache;
-    let permissionCacheService;
-    let getAllAndOverrideMock;
-    beforeEach(()=>{
-        reflector = new Reflector();
-        cache = {
-            get: jest.fn(),
-            set: jest.fn(),
-            del: jest.fn()
-        };
-        permissionCacheService = buildPermissionService(cache);
-        getAllAndOverrideMock = jest.fn();
-        jest.spyOn(reflector, 'getAllAndOverride').mockImplementation(getAllAndOverrideMock);
-    });
-    function mockMetadata(isPublic, permissionConfig) {
-        getAllAndOverrideMock.mockImplementation((key)=>{
-            if (key === IS_PUBLIC_KEY) return isPublic;
-            if (key === PERMISSIONS_KEY) return permissionConfig;
-            return undefined;
-        });
-    }
-    describe('public routes and missing permission metadata', ()=>{
-        it('should allow access when the route is public', async ()=>{
-            mockMetadata(true, undefined);
-            const guard = new PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({}))).resolves.toBe(true);
-        });
-        it('should allow access when no permission metadata is set', async ()=>{
-            mockMetadata(false, undefined);
-            const guard = new PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).resolves.toBe(true);
-        });
-    });
-    describe('authentication requirement', ()=>{
-        it('should throw UnauthorizedException when there is no user on the request', async ()=>{
-            mockMetadata(false, 'user.read');
-            const guard = new PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({}))).rejects.toMatchObject({
-                constructor: UnauthorizedException
-            });
-            try {
-                await guard.canActivate(buildContext({}));
-            } catch (error) {
-                expect(error.getResponse()).toMatchObject({
-                    messageKey: AUTH_MESSAGES.TOKEN_REQUIRED
-                });
-            }
-        });
-    });
-    describe('cache availability', ()=>{
-        it('should throw PermissionSystemUnavailableException when no cache is injected', async ()=>{
-            mockMetadata(false, 'user.read');
-            const guard = new PermissionGuard(reflector, buildPermissionService(undefined));
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).rejects.toBeInstanceOf(PermissionSystemUnavailableException);
-        });
-        it('should throw PermissionSystemUnavailableException when no permission service is injected', async ()=>{
-            mockMetadata(false, 'user.read');
-            const guard = new PermissionGuard(reflector, undefined);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).rejects.toBeInstanceOf(PermissionSystemUnavailableException);
-        });
-    });
-    describe('permission resolution', ()=>{
-        it('should throw NoPermissionsFoundException when the user has no cached permissions', async ()=>{
-            mockMetadata(false, 'user.read');
-            cache.get.mockResolvedValue(undefined);
-            const guard = new PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).rejects.toBeInstanceOf(NoPermissionsFoundException);
-        });
-        it('should throw NoPermissionsFoundException when the cached permission array is empty', async ()=>{
-            mockMetadata(false, 'user.read');
-            cache.get.mockResolvedValue([]);
-            const guard = new PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).rejects.toBeInstanceOf(NoPermissionsFoundException);
-        });
-        it('should allow access for a single string permission that the user has', async ()=>{
-            mockMetadata(false, 'user.read');
-            cache.get.mockResolvedValue([
-                'user.read'
-            ]);
-            const guard = new PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).resolves.toBe(true);
-        });
-        it('should throw InsufficientPermissionsException for a single string permission the user lacks', async ()=>{
-            mockMetadata(false, 'user.write');
-            cache.get.mockResolvedValue([
-                'user.read'
-            ]);
-            const guard = new PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).rejects.toBeInstanceOf(InsufficientPermissionsException);
-        });
-        it('should support a wildcard "*" permission granting everything', async ()=>{
-            mockMetadata(false, 'anything.here');
-            cache.get.mockResolvedValue([
-                '*'
-            ]);
-            const guard = new PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).resolves.toBe(true);
-        });
-        it('should support a namespaced wildcard like "user.*"', async ()=>{
-            mockMetadata(false, 'user.delete');
-            cache.get.mockResolvedValue([
-                'user.*'
-            ]);
-            const guard = new PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).resolves.toBe(true);
-        });
-        it('should evaluate an array of permissions as AND logic', async ()=>{
-            mockMetadata(false, [
-                'user.read',
-                'user.write'
-            ]);
-            cache.get.mockResolvedValue([
-                'user.read'
-            ]);
-            const guard = new PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).rejects.toBeInstanceOf(InsufficientPermissionsException);
-        });
-        it('should pass an array of permissions when the user has all of them', async ()=>{
-            mockMetadata(false, [
-                'user.read',
-                'user.write'
-            ]);
-            cache.get.mockResolvedValue([
-                'user.read',
-                'user.write'
-            ]);
-            const guard = new PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).resolves.toBe(true);
-        });
-        it('should return true for an empty permission array (no-op logic node)', async ()=>{
-            mockMetadata(false, []);
-            cache.get.mockResolvedValue([
-                'user.read'
-            ]);
-            const guard = new PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).resolves.toBe(true);
-        });
-        it('should evaluate SimplePermissionConfig with OR operator', async ()=>{
-            mockMetadata(false, {
-                permissions: [
-                    'admin',
-                    'manager'
-                ],
-                operator: 'OR'
-            });
-            cache.get.mockResolvedValue([
-                'manager'
-            ]);
-            const guard = new PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).resolves.toBe(true);
-        });
-        it('should reject SimplePermissionConfig with OR operator when none match', async ()=>{
-            mockMetadata(false, {
-                permissions: [
-                    'admin',
-                    'manager'
-                ],
-                operator: 'OR'
-            });
-            cache.get.mockResolvedValue([
-                'guest'
-            ]);
-            const guard = new PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).rejects.toBeInstanceOf(InsufficientPermissionsException);
-        });
-        it('should return true for SimplePermissionConfig with an empty permissions array', async ()=>{
-            mockMetadata(false, {
-                permissions: [],
-                operator: 'AND'
-            });
-            cache.get.mockResolvedValue([
-                'user.read'
-            ]);
-            const guard = new PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).resolves.toBe(true);
-        });
-        it('should evaluate a nested ILogicNode tree (AND of action + OR group)', async ()=>{
-            mockMetadata(false, {
-                type: 'group',
-                operator: 'AND',
-                children: [
-                    {
-                        type: 'action',
-                        actionId: 'users.read'
-                    },
-                    {
-                        type: 'group',
-                        operator: 'OR',
-                        children: [
-                            {
-                                type: 'action',
-                                actionId: 'admin'
-                            },
-                            {
-                                type: 'action',
-                                actionId: 'manager'
-                            }
-                        ]
-                    }
-                ]
-            });
-            cache.get.mockResolvedValue([
-                'users.read',
-                'manager'
-            ]);
-            const guard = new PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).resolves.toBe(true);
-        });
-        it('should fail-closed on a group node with no children', async ()=>{
-            mockMetadata(false, {
-                type: 'group',
-                operator: 'AND',
-                children: []
-            });
-            cache.get.mockResolvedValue([
-                'user.read'
-            ]);
-            const guard = new PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).rejects.toBeInstanceOf(InsufficientPermissionsException);
-        });
-        it('should read backendCodes from an object-shaped cache value', async ()=>{
-            mockMetadata(false, 'user.read');
-            cache.get.mockResolvedValue({
-                backendCodes: [
-                    'user.read'
-                ]
-            });
-            const guard = new PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).resolves.toBe(true);
-        });
-        it('should treat an object-shaped cache value with no backendCodes as no permissions', async ()=>{
-            mockMetadata(false, 'user.read');
-            cache.get.mockResolvedValue({});
-            const guard = new PermissionGuard(reflector, permissionCacheService);
-            await expect(guard.canActivate(buildContext({
-                user: {
-                    id: 'u1'
-                }
-            }))).rejects.toBeInstanceOf(NoPermissionsFoundException);
-        });
-    });
-    describe('company-scoped cache key', ()=>{
-        it('should include companyId/branchId in the cache lookup when company feature is enabled', async ()=>{
-            mockMetadata(false, 'user.read');
-            cache.get.mockResolvedValue([
-                'user.read'
-            ]);
-            const guard = new PermissionGuard(reflector, buildPermissionService(cache, {
-                enableCompanyFeature: true
-            }));
-            await guard.canActivate(buildContext({
-                user: {
-                    id: 'u1',
-                    companyId: 'c1',
-                    branchId: 'b1'
-                }
-            }));
-            expect(cache.get).toHaveBeenCalledWith(expect.stringContaining('company:c1:branch:b1:user:u1'));
-        });
-        it('should fall back to the user-scoped cache key when company feature is disabled', async ()=>{
-            mockMetadata(false, 'user.read');
-            cache.get.mockResolvedValue([
-                'user.read'
-            ]);
-            const guard = new PermissionGuard(reflector, permissionCacheService);
-            await guard.canActivate(buildContext({
-                user: {
-                    id: 'u1',
-                    companyId: 'c1',
-                    branchId: 'b1'
-                }
-            }));
-            expect(cache.get).toHaveBeenCalledWith(expect.stringContaining(':user:u1'));
-            expect(cache.get).toHaveBeenCalledWith(expect.not.stringContaining('company'));
-        });
-    });
-});

package/fesm/interceptors/delete-empty-id-from-body.interceptor.js

@@ -1,30 +0,0 @@
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-import { Injectable } from '@nestjs/common';
-export class DeleteEmptyIdFromBodyInterceptor {
-    intercept(context, next) {
-        const request = context.switchToHttp().getRequest();
-        if (Array.isArray(request.body)) {
-            request.body = request.body.map((item)=>{
-                if (!item?.id || item?.id === '' || item?.id === null) {
-                    delete item.id;
-                }
-                return item;
-            });
-        } else if (typeof request.body === 'object' && request.body !== null) {
-            const item = request.body;
-            if (!item?.id || item?.id === '' || item?.id === null) {
-                delete item.id;
-            }
-            request.body = item;
-        }
-        return next.handle();
-    }
-}
-DeleteEmptyIdFromBodyInterceptor = _ts_decorate([
-    Injectable()
-], DeleteEmptyIdFromBodyInterceptor);

package/fesm/interceptors/delete-empty-id-from-body.interceptor.spec.js

@@ -1,103 +0,0 @@
-import { of } from 'rxjs';
-import { DeleteEmptyIdFromBodyInterceptor } from './delete-empty-id-from-body.interceptor';
-function buildContext(body) {
-    const request = {
-        body
-    };
-    const context = {
-        switchToHttp: ()=>({
-                getRequest: ()=>request
-            })
-    };
-    return {
-        context,
-        request
-    };
-}
-function buildCallHandler() {
-    return {
-        handle: jest.fn().mockReturnValue(of('next-result'))
-    };
-}
-describe('DeleteEmptyIdFromBodyInterceptor', ()=>{
-    let interceptor;
-    beforeEach(()=>{
-        interceptor = new DeleteEmptyIdFromBodyInterceptor();
-    });
-    it('should delete an empty-string id on a single object body', ()=>{
-        const { context, request } = buildContext({
-            id: '',
-            name: 'Product'
-        });
-        interceptor.intercept(context, buildCallHandler());
-        expect(request.body).toEqual({
-            name: 'Product'
-        });
-    });
-    it('should delete a null id on a single object body', ()=>{
-        const { context, request } = buildContext({
-            id: null,
-            name: 'Product'
-        });
-        interceptor.intercept(context, buildCallHandler());
-        expect(request.body).toEqual({
-            name: 'Product'
-        });
-    });
-    it('should keep a truthy id on a single object body', ()=>{
-        const { context, request } = buildContext({
-            id: 'uuid-1',
-            name: 'Product'
-        });
-        interceptor.intercept(context, buildCallHandler());
-        expect(request.body).toEqual({
-            id: 'uuid-1',
-            name: 'Product'
-        });
-    });
-    it('should strip empty ids from each item in an array body', ()=>{
-        const { context, request } = buildContext([
-            {
-                id: '',
-                name: 'A'
-            },
-            {
-                id: 'uuid-2',
-                name: 'B'
-            },
-            {
-                id: null,
-                name: 'C'
-            }
-        ]);
-        interceptor.intercept(context, buildCallHandler());
-        expect(request.body).toEqual([
-            {
-                name: 'A'
-            },
-            {
-                id: 'uuid-2',
-                name: 'B'
-            },
-            {
-                name: 'C'
-            }
-        ]);
-    });
-    it('should leave a null body untouched', ()=>{
-        const { context, request } = buildContext(null);
-        interceptor.intercept(context, buildCallHandler());
-        expect(request.body).toBeNull();
-    });
-    it('should call next.handle() and return its observable', (done)=>{
-        const { context } = buildContext({
-            id: ''
-        });
-        const callHandler = buildCallHandler();
-        interceptor.intercept(context, callHandler).subscribe((value)=>{
-            expect(value).toBe('next-result');
-            expect(callHandler.handle).toHaveBeenCalled();
-            done();
-        });
-    });
-});