@flusys/nestjs-shared 9.1.0-rc.1 → 9.1.1

package/fesm/470.js

@@ -2224,6 +2224,8 @@ OptionalJwtGuard = optional_jwt_auth_guard_ts_decorate([
 var permission_exception = __webpack_require__(374);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/modules/shared-permission-cache/shared-permission-cache.service.ts
 var shared_permission_cache_service = __webpack_require__(657);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/permission-match.util.ts
+var permission_match_util = __webpack_require__(788);
 ;// CONCATENATED MODULE: ./projects/nestjs-shared/src/guards/permission.guard.ts
 function permission_guard_ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -2253,6 +2255,7 @@ function permission_guard_ts_param(paramIndex, decorator) {
 
 
 
+
 class PermissionGuard {
     reflector;
     permissionCacheService;
@@ -2280,8 +2283,7 @@ class PermissionGuard {
         if (!this.permissionCacheService?.isCacheConfigured()) {
             throw new permission_exception/* .PermissionSystemUnavailableException */.GS();
         }
-        const permissionService = this.permissionCacheService;
-        const userPermissions = await permissionService.getPermissions({
+        const userPermissions = await this.permissionCacheService.getPermissions({
             userId: user.id,
             companyId: user.companyId,
             branchId: user.branchId
@@ -2291,7 +2293,7 @@ class PermissionGuard {
         }
         const logicNode = this.normalizeToLogicNode(permissionConfig);
         if (!logicNode) return true;
-        const result = this.evaluateLogicNode(logicNode, userPermissions, permissionService);
+        const result = (0,permission_match_util/* .evaluatePermissionLogic */.Ng)(logicNode, userPermissions);
         if (!result.passed) {
             throw new permission_exception/* .InsufficientPermissionsException */.z8(result.missingPermissions, result.operator);
         }
@@ -2341,43 +2343,6 @@ class PermissionGuard {
         // ILogicNode
         return config;
     }
-    evaluateLogicNode(node, userPermissions, permissionService) {
-        if (node.type === 'action') {
-            const passed = permissionService.matchPermission(userPermissions, node.actionId);
-            return {
-                passed,
-                missingPermissions: passed ? [] : [
-                    node.actionId
-                ],
-                operator: 'AND'
-            };
-        }
-        // Group node
-        const { operator, children } = node;
-        // SECURITY: Fail-closed - deny access when no children configured
-        if (!children || children.length === 0) {
-            return {
-                passed: false,
-                missingPermissions: [],
-                operator
-            };
-        }
-        const results = [];
-        const missingPermissions = [];
-        for (const child of children){
-            const childResult = this.evaluateLogicNode(child, userPermissions, permissionService);
-            results.push(childResult.passed);
-            if (!childResult.passed) {
-                missingPermissions.push(...childResult.missingPermissions);
-            }
-        }
-        const passed = operator === 'OR' ? results.some((r)=>r) : results.every((r)=>r);
-        return {
-            passed,
-            missingPermissions: passed ? [] : missingPermissions,
-            operator
-        };
-    }
 }
 PermissionGuard = permission_guard_ts_decorate([
     (0,common_.Injectable)(),

package/fesm/681.js

@@ -611,11 +611,21 @@ class SharedPermissionCacheService {
             requiredPermission
         ], 'AND');
     }
+    /** Throws 403 (naming what is missing) unless `user` passes the AND / OR tree; fails closed (500) when no cache is wired up. */ async assertPermissionLogic(user, logic) {
+        if (!this.isCacheConfigured()) throw new _exceptions_permission_exception_js__rspack_import_3/* .PermissionSystemUnavailableException */.GS();
+        const granted = user?.id ? await this.getPermissions({
+            userId: user.id,
+            companyId: user.companyId,
+            branchId: user.branchId
+        }) : [];
+        const result = (0,_utils_permission_match_util_js__rspack_import_5/* .evaluatePermissionLogic */.Ng)(logic, granted);
+        if (!result.passed) throw new _exceptions_permission_exception_js__rspack_import_3/* .InsufficientPermissionsException */.z8(result.missingPermissions, result.operator);
+    }
     /** Whether a cache instance is wired up; false means permission checks can't be served at all */ isCacheConfigured() {
         return !!this.cache;
     }
     /** Match an already-fetched permission list against a required permission, honoring `*` and `prefix.*` wildcards */ matchPermission(userPermissions, requiredPermission) {
-        return (0,_utils_permission_match_util_js__rspack_import_5/* .matchesPermission */.x)(userPermissions, requiredPermission);
+        return (0,_utils_permission_match_util_js__rspack_import_5/* .matchesPermission */.xY)(userPermissions, requiredPermission);
     }
 }
 SharedPermissionCacheService = _ts_decorate([
@@ -843,6 +853,8 @@ __webpack_require__.d(__webpack_exports__, {
 
 },
 788(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _exceptions_permission_exception_js__rspack_import_0 = __webpack_require__(374);
+
 /** Whether `granted` covers `required`, honoring `*` (everything) and `prefix.*` (everything under prefix) wildcards */ function matchesPermission(granted, required) {
     if (granted.includes(required)) return true;
     for (const permission of granted){
@@ -851,9 +863,73 @@ __webpack_require__.d(__webpack_exports__, {
     }
     return false;
 }
+/** Evaluates an AND / OR permission tree against `granted`; a group without children fails closed. */ function evaluatePermissionLogic(node, granted) {
+    if (node.type === 'action') {
+        const passed = matchesPermission(granted, node.actionId);
+        return {
+            passed,
+            missingPermissions: passed ? [] : [
+                node.actionId
+            ],
+            operator: 'AND'
+        };
+    }
+    const { operator, children } = node;
+    if (!children?.length) return {
+        passed: false,
+        missingPermissions: [],
+        operator
+    };
+    const results = children.map((child)=>evaluatePermissionLogic(child, granted));
+    const passed = operator === 'OR' ? results.some((r)=>r.passed) : results.every((r)=>r.passed);
+    return {
+        passed,
+        missingPermissions: passed ? [] : results.flatMap((r)=>r.missingPermissions),
+        operator
+    };
+}
+/** Every permission code a tree names, each once, in order. */ function permissionLogicCodes(node) {
+    if (node.type === 'action') return node.actionId ? [
+        node.actionId
+    ] : [];
+    return [
+        ...new Set((node.children ?? []).flatMap(permissionLogicCodes))
+    ];
+}
+/** Groups nested in a permission rule, the outer one included. */ const MAX_PERMISSION_LOGIC_DEPTH = 5;
+/** Permission codes one rule may name. */ const MAX_PERMISSION_LOGIC_CODES = 50;
+const MAX_PERMISSION_CODE_LENGTH = 255;
+/** What is wrong with a stored permission rule: `invalid` (its shape), `empty` (it names no permission), `too_many` codes, or null. */ function permissionLogicProblem(value) {
+    let codes = 0;
+    const walk = (node, depth)=>{
+        if (!node || typeof node !== 'object' || Array.isArray(node)) return false;
+        const n = node;
+        if (n['type'] === 'action') {
+            codes++;
+            return typeof n['actionId'] === 'string' && n['actionId'].trim() !== '' && n['actionId'].length <= MAX_PERMISSION_CODE_LENGTH;
+        }
+        if (n['type'] !== 'group' || n['operator'] !== 'AND' && n['operator'] !== 'OR' || !Array.isArray(n['children'])) return false;
+        if (depth >= MAX_PERMISSION_LOGIC_DEPTH || !n['children'].length) return false;
+        return n['children'].every((child)=>walk(child, depth + 1));
+    };
+    if (!value || typeof value !== 'object') return 'invalid';
+    const node = value;
+    if (node['type'] === 'group' && (node['operator'] === 'AND' || node['operator'] === 'OR') && Array.isArray(node['children']) && !node['children'].length) return 'empty';
+    if (!walk(value, 0)) return 'invalid';
+    return codes > MAX_PERMISSION_LOGIC_CODES ? 'too_many' : null;
+}
+/** A user's codes in `scope`, from the resolver or else the cache; with neither, fails closed with PermissionSystemUnavailableException. */ async function loadPermissionCodes(scope, sources) {
+    if (sources.resolver) return sources.resolver.getPermissionCodes(scope);
+    if (sources.cache?.isCacheConfigured()) return sources.cache.getPermissions(scope);
+    throw new _exceptions_permission_exception_js__rspack_import_0/* .PermissionSystemUnavailableException */.GS();
+}
 
 __webpack_require__.d(__webpack_exports__, {
-  x: () => (matchesPermission)
+  CQ: () => (loadPermissionCodes),
+  HU: () => (permissionLogicProblem),
+  MO: () => (permissionLogicCodes),
+  Ng: () => (evaluatePermissionLogic),
+  xY: () => (matchesPermission)
 });
 
 

package/fesm/948.js

@@ -522,7 +522,6 @@ const FLOW_DEFINITION_PERMISSIONS = {
     UPDATE: 'entity_builder.flow_definition.update',
     DELETE: 'entity_builder.flow_definition.delete',
     TEST: 'entity_builder.flow_definition.test',
-    /** Needed to save a flow that runs as the system (bypassing per-entity permissions). */ SYSTEM: 'entity_builder.flow_definition.system',
     /** Needed to save a flow containing a code node (sandboxed JavaScript). */ CODE: 'entity_builder.flow_definition.code'
 };
 const ENTITY_BUILDER_DYNAMIC_PREFIX = 'entity_builder.entity';

package/fesm/constants/index.js

@@ -273,7 +273,6 @@ const FLOW_DEFINITION_PERMISSIONS = {
     UPDATE: 'entity_builder.flow_definition.update',
     DELETE: 'entity_builder.flow_definition.delete',
     TEST: 'entity_builder.flow_definition.test',
-    /** Needed to save a flow that runs as the system (bypassing per-entity permissions). */ SYSTEM: 'entity_builder.flow_definition.system',
     /** Needed to save a flow containing a code node (sandboxed JavaScript). */ CODE: 'entity_builder.flow_definition.code'
 };
 const ENTITY_BUILDER_DYNAMIC_PREFIX = 'entity_builder.entity';

package/fesm/guards/index.js

@@ -287,6 +287,8 @@ OptionalJwtGuard = optional_jwt_auth_guard_ts_decorate([
 var permission_exception = __webpack_require__(374);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/modules/shared-permission-cache/shared-permission-cache.service.ts
 var shared_permission_cache_service = __webpack_require__(657);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/permission-match.util.ts
+var permission_match_util = __webpack_require__(788);
 ;// CONCATENATED MODULE: ./projects/nestjs-shared/src/guards/permission.guard.ts
 function permission_guard_ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -316,6 +318,7 @@ function permission_guard_ts_param(paramIndex, decorator) {
 
 
 
+
 class PermissionGuard {
     reflector;
     permissionCacheService;
@@ -343,8 +346,7 @@ class PermissionGuard {
         if (!this.permissionCacheService?.isCacheConfigured()) {
             throw new permission_exception/* .PermissionSystemUnavailableException */.GS();
         }
-        const permissionService = this.permissionCacheService;
-        const userPermissions = await permissionService.getPermissions({
+        const userPermissions = await this.permissionCacheService.getPermissions({
             userId: user.id,
             companyId: user.companyId,
             branchId: user.branchId
@@ -354,7 +356,7 @@ class PermissionGuard {
         }
         const logicNode = this.normalizeToLogicNode(permissionConfig);
         if (!logicNode) return true;
-        const result = this.evaluateLogicNode(logicNode, userPermissions, permissionService);
+        const result = (0,permission_match_util/* .evaluatePermissionLogic */.Ng)(logicNode, userPermissions);
         if (!result.passed) {
             throw new permission_exception/* .InsufficientPermissionsException */.z8(result.missingPermissions, result.operator);
         }
@@ -404,43 +406,6 @@ class PermissionGuard {
         // ILogicNode
         return config;
     }
-    evaluateLogicNode(node, userPermissions, permissionService) {
-        if (node.type === 'action') {
-            const passed = permissionService.matchPermission(userPermissions, node.actionId);
-            return {
-                passed,
-                missingPermissions: passed ? [] : [
-                    node.actionId
-                ],
-                operator: 'AND'
-            };
-        }
-        // Group node
-        const { operator, children } = node;
-        // SECURITY: Fail-closed - deny access when no children configured
-        if (!children || children.length === 0) {
-            return {
-                passed: false,
-                missingPermissions: [],
-                operator
-            };
-        }
-        const results = [];
-        const missingPermissions = [];
-        for (const child of children){
-            const childResult = this.evaluateLogicNode(child, userPermissions, permissionService);
-            results.push(childResult.passed);
-            if (!childResult.passed) {
-                missingPermissions.push(...childResult.missingPermissions);
-            }
-        }
-        const passed = operator === 'OR' ? results.some((r)=>r) : results.every((r)=>r);
-        return {
-            passed,
-            missingPermissions: passed ? [] : missingPermissions,
-            operator
-        };
-    }
 }
 PermissionGuard = permission_guard_ts_decorate([
     (0,common_.Injectable)(),
@@ -541,11 +506,21 @@ class SharedPermissionCacheService {
             requiredPermission
         ], 'AND');
     }
+    /** Throws 403 (naming what is missing) unless `user` passes the AND / OR tree; fails closed (500) when no cache is wired up. */ async assertPermissionLogic(user, logic) {
+        if (!this.isCacheConfigured()) throw new _exceptions_permission_exception_js__rspack_import_3/* .PermissionSystemUnavailableException */.GS();
+        const granted = user?.id ? await this.getPermissions({
+            userId: user.id,
+            companyId: user.companyId,
+            branchId: user.branchId
+        }) : [];
+        const result = (0,_utils_permission_match_util_js__rspack_import_5/* .evaluatePermissionLogic */.Ng)(logic, granted);
+        if (!result.passed) throw new _exceptions_permission_exception_js__rspack_import_3/* .InsufficientPermissionsException */.z8(result.missingPermissions, result.operator);
+    }
     /** Whether a cache instance is wired up; false means permission checks can't be served at all */ isCacheConfigured() {
         return !!this.cache;
     }
     /** Match an already-fetched permission list against a required permission, honoring `*` and `prefix.*` wildcards */ matchPermission(userPermissions, requiredPermission) {
-        return (0,_utils_permission_match_util_js__rspack_import_5/* .matchesPermission */.x)(userPermissions, requiredPermission);
+        return (0,_utils_permission_match_util_js__rspack_import_5/* .matchesPermission */.xY)(userPermissions, requiredPermission);
     }
 }
 SharedPermissionCacheService = _ts_decorate([
@@ -590,6 +565,8 @@ __webpack_require__.d(__webpack_exports__, {
 
 },
 788(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _exceptions_permission_exception_js__rspack_import_0 = __webpack_require__(374);
+
 /** Whether `granted` covers `required`, honoring `*` (everything) and `prefix.*` (everything under prefix) wildcards */ function matchesPermission(granted, required) {
     if (granted.includes(required)) return true;
     for (const permission of granted){
@@ -598,9 +575,73 @@ __webpack_require__.d(__webpack_exports__, {
     }
     return false;
 }
+/** Evaluates an AND / OR permission tree against `granted`; a group without children fails closed. */ function evaluatePermissionLogic(node, granted) {
+    if (node.type === 'action') {
+        const passed = matchesPermission(granted, node.actionId);
+        return {
+            passed,
+            missingPermissions: passed ? [] : [
+                node.actionId
+            ],
+            operator: 'AND'
+        };
+    }
+    const { operator, children } = node;
+    if (!children?.length) return {
+        passed: false,
+        missingPermissions: [],
+        operator
+    };
+    const results = children.map((child)=>evaluatePermissionLogic(child, granted));
+    const passed = operator === 'OR' ? results.some((r)=>r.passed) : results.every((r)=>r.passed);
+    return {
+        passed,
+        missingPermissions: passed ? [] : results.flatMap((r)=>r.missingPermissions),
+        operator
+    };
+}
+/** Every permission code a tree names, each once, in order. */ function permissionLogicCodes(node) {
+    if (node.type === 'action') return node.actionId ? [
+        node.actionId
+    ] : [];
+    return [
+        ...new Set((node.children ?? []).flatMap(permissionLogicCodes))
+    ];
+}
+/** Groups nested in a permission rule, the outer one included. */ const MAX_PERMISSION_LOGIC_DEPTH = 5;
+/** Permission codes one rule may name. */ const MAX_PERMISSION_LOGIC_CODES = 50;
+const MAX_PERMISSION_CODE_LENGTH = 255;
+/** What is wrong with a stored permission rule: `invalid` (its shape), `empty` (it names no permission), `too_many` codes, or null. */ function permissionLogicProblem(value) {
+    let codes = 0;
+    const walk = (node, depth)=>{
+        if (!node || typeof node !== 'object' || Array.isArray(node)) return false;
+        const n = node;
+        if (n['type'] === 'action') {
+            codes++;
+            return typeof n['actionId'] === 'string' && n['actionId'].trim() !== '' && n['actionId'].length <= MAX_PERMISSION_CODE_LENGTH;
+        }
+        if (n['type'] !== 'group' || n['operator'] !== 'AND' && n['operator'] !== 'OR' || !Array.isArray(n['children'])) return false;
+        if (depth >= MAX_PERMISSION_LOGIC_DEPTH || !n['children'].length) return false;
+        return n['children'].every((child)=>walk(child, depth + 1));
+    };
+    if (!value || typeof value !== 'object') return 'invalid';
+    const node = value;
+    if (node['type'] === 'group' && (node['operator'] === 'AND' || node['operator'] === 'OR') && Array.isArray(node['children']) && !node['children'].length) return 'empty';
+    if (!walk(value, 0)) return 'invalid';
+    return codes > MAX_PERMISSION_LOGIC_CODES ? 'too_many' : null;
+}
+/** A user's codes in `scope`, from the resolver or else the cache; with neither, fails closed with PermissionSystemUnavailableException. */ async function loadPermissionCodes(scope, sources) {
+    if (sources.resolver) return sources.resolver.getPermissionCodes(scope);
+    if (sources.cache?.isCacheConfigured()) return sources.cache.getPermissions(scope);
+    throw new _exceptions_permission_exception_js__rspack_import_0/* .PermissionSystemUnavailableException */.GS();
+}
 
 __webpack_require__.d(__webpack_exports__, {
-  x: () => (matchesPermission)
+  CQ: () => (loadPermissionCodes),
+  HU: () => (permissionLogicProblem),
+  MO: () => (permissionLogicCodes),
+  Ng: () => (evaluatePermissionLogic),
+  xY: () => (matchesPermission)
 });