@flusys/nestjs-shared 9.1.1 → 9.2.0

package/fesm/guards/index.js

@@ -6,7 +6,7 @@ import * as __rspack_external_keyv from "keyv";
 export const __rspack_esm_id = 333;
 export const __rspack_esm_ids = [333];
 export const __webpack_modules__ = {
-375(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+5375(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
@@ -14,25 +14,41 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 // EXTERNAL MODULE: external "@flusys/nestjs-core/config"
-var config_ = __webpack_require__(307);
+var config_ = __webpack_require__(8307);
 ;// CONCATENATED MODULE: external "@keyv/redis"
 
 ;// CONCATENATED MODULE: external "cacheable"
 
 ;// CONCATENATED MODULE: external "keyv"
 
+// EXTERNAL MODULE: external "node:crypto"
+var external_node_crypto_ = __webpack_require__(2561);
 ;// CONCATENATED MODULE: ./projects/nestjs-shared/src/classes/hybrid-cache.class.ts
 
 
 
 
-class HybridCache {
+
+const RAW_KEY_PREFIX = 'flusys';
+const STAMP_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+/**
+ * L1 in-process memory + L2 Redis, chosen by `USE_CACHE_LABEL` (memory | redis | hybrid).
+ *
+ * Plain `get`/`set` may be served by L1, which other instances cannot invalidate, so a value
+ * read that way must be immutable for its key - which is what version stamps give: data keys
+ * embed the current stamp, and invalidation moves the stamp instead of deleting entries.
+ * Stamps and claims live outside Keyv so they can be set atomically (Redis `SET NX`).
+ */ class HybridCache {
+    mode;
+    defaultTtl;
     memory;
     redis;
+    redisStore;
+    localAtomic;
     constructor(memoryTtl = 60 * 1000, memorySize = 5000){
-        // Default to 'memory' if not specified
-        const useCacheLabel = config_.envConfig.tryGetValue('USE_CACHE_LABEL', false) || 'memory';
-        if (useCacheLabel === 'memory' || useCacheLabel === 'hybrid') {
+        this.mode = config_.envConfig.tryGetValue('USE_CACHE_LABEL', false) || 'memory';
+        this.defaultTtl = memoryTtl;
+        if (this.mode === 'memory' || this.mode === 'hybrid') {
             this.memory = new __rspack_external_keyv["default"]({
                 store: new __rspack_external_cacheable.CacheableMemory({
                     ttl: memoryTtl,
@@ -40,35 +56,51 @@ class HybridCache {
                 })
             });
         }
-        if (useCacheLabel === 'redis' || useCacheLabel === 'hybrid') {
+        if (this.mode === 'redis' || this.mode === 'hybrid') {
+            this.redisStore = new __rspack_external__keyv_redis_139d03ca["default"](config_.envConfig.getRedisUrl());
             this.redis = new __rspack_external_keyv["default"]({
-                store: new __rspack_external__keyv_redis_139d03ca["default"](config_.envConfig.getRedisUrl())
+                store: this.redisStore
+            });
+        } else {
+            // Stamps and claims must never be LRU-evicted while still referenced
+            this.localAtomic = new __rspack_external_cacheable.CacheableMemory({
+                ttl: STAMP_TTL_MS,
+                lruSize: 0,
+                checkInterval: 60_000
             });
         }
     }
-    async get(key) {
-        // Prefer memory first if available
-        if (this.memory) {
+    getMode() {
+        return this.mode;
+    }
+    async get(key, options = {}) {
+        const useMemory = this.memory && !(options.skipMemory && this.redis);
+        if (useMemory) {
             const value = await this.memory.get(key);
             if (value !== undefined) return value;
         }
-        // Fallback to redis
         if (this.redis) {
-            const value = await this.redis.get(key);
-            if (value !== undefined && this.memory) {
-                // backfill L1 memory cache
-                await this.memory.set(key, value);
+            const raw = await this.redis.get(key, {
+                raw: true
+            });
+            if (raw === undefined) return undefined;
+            if (useMemory) {
+                // Never let the L1 copy outlive the Redis entry (time-bound values such as permissions)
+                const remaining = raw.expires ? raw.expires - Date.now() : this.defaultTtl;
+                if (remaining > 0) await this.memory.set(key, raw.value, Math.min(remaining, this.defaultTtl));
             }
-            return value;
+            return raw.value;
         }
         return undefined;
     }
-    async set(key, value, ttl) {
-        if (this.memory) {
-            await this.memory.set(key, value, ttl);
+    async set(key, value, ttl, options = {}) {
+        const effectiveTtl = ttl ?? this.defaultTtl;
+        const useMemory = this.memory && !(options.skipMemory && this.redis);
+        if (useMemory) {
+            await this.memory.set(key, value, effectiveTtl);
         }
         if (this.redis) {
-            await this.redis.set(key, value, ttl);
+            await this.redis.set(key, value, effectiveTtl);
         }
     }
     async del(key) {
@@ -79,23 +111,88 @@ class HybridCache {
             await this.redis.delete(key);
         }
     }
-    async reset() {
-        if (this.memory) {
-            await this.memory.clear();
+    /**
+   * The current version stamp for `name`, creating one when absent. A missing stamp is always
+   * replaced by a fresh random one - never a fixed default - so entries cached under a stamp that
+   * expired or was lost can never become current again.
+   */ async getStamp(name) {
+        const key = this.rawKey('stamp', name);
+        if (this.localAtomic) {
+            let stamp = this.localAtomic.get(key);
+            if (!stamp) {
+                stamp = (0,external_node_crypto_.randomUUID)();
+                this.localAtomic.set(key, stamp);
+            }
+            return stamp;
         }
+        const client = await this.redisStore.getClient();
+        const existing = await client.get(key);
+        if (existing) return String(existing);
+        const candidate = (0,external_node_crypto_.randomUUID)();
+        await client.set(key, candidate, {
+            NX: true,
+            PX: STAMP_TTL_MS
+        });
+        // A key evicted between SET NX and GET must not turn into the fixed stamp "null"
+        return String(await client.get(key) ?? candidate);
+    }
+    /** Moves the stamp for `name`, orphaning every entry cached under the previous one on all instances */ async bumpStamp(name) {
+        const key = this.rawKey('stamp', name);
+        if (this.localAtomic) {
+            this.localAtomic.set(key, (0,external_node_crypto_.randomUUID)());
+            return;
+        }
+        const client = await this.redisStore.getClient();
+        await client.set(key, (0,external_node_crypto_.randomUUID)(), {
+            PX: STAMP_TTL_MS
+        });
     }
-    async resetL2() {
-        if (this.redis) {
-            await this.redis.clear();
+    /** Atomically claims `name` for `ttl` ms; true only for the first caller while the claim lives */ async claim(name, ttl) {
+        const key = this.rawKey('claim', name);
+        if (this.localAtomic) {
+            if (this.localAtomic.has(key)) return false;
+            this.localAtomic.set(key, true, ttl);
+            return true;
+        }
+        const client = await this.redisStore.getClient();
+        return await client.set(key, '1', {
+            NX: true,
+            PX: ttl
+        }) !== null;
+    }
+    async releaseClaim(name) {
+        const key = this.rawKey('claim', name);
+        if (this.localAtomic) {
+            this.localAtomic.delete(key);
+            return;
         }
+        const client = await this.redisStore.getClient();
+        await client.del(key);
+    }
+    /**
+   * Reads and removes a one-time value; only one caller across all instances ever receives it.
+   * The claim is per value, so a fresh value later stored under the same key (a resent code)
+   * can be taken again while the claim on the consumed one is still alive.
+   */ async take(key, ttl) {
+        const value = await this.get(key, {
+            skipMemory: true
+        });
+        if (value === undefined) return undefined;
+        const digest = (0,external_node_crypto_.createHash)('sha256').update(JSON.stringify(value) ?? '').digest('hex');
+        if (!await this.claim(`take:${key}:${digest}`, ttl)) return undefined;
+        await this.del(key);
+        return value;
+    }
+    rawKey(kind, name) {
+        return `${RAW_KEY_PREFIX}:${kind}:${name}`;
     }
 }
 
 
 },
-374(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(157);
-/* import */ var _constants_message_keys_js__rspack_import_1 = __webpack_require__(389);
+8374(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(6157);
+/* import */ var _constants_message_keys_js__rspack_import_1 = __webpack_require__(4389);
 
 
 class PermissionSystemUnavailableException extends _nestjs_common__rspack_import_0.InternalServerErrorException {
@@ -140,7 +237,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-510(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+3510(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
@@ -150,13 +247,13 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/index.ts
-var constants = __webpack_require__(43);
-// EXTERNAL MODULE: ./projects/nestjs-shared/src/middlewares/logger.middleware.ts + 2 modules
-var logger_middleware = __webpack_require__(591);
+var constants = __webpack_require__(6043);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/middlewares/logger.middleware.ts + 1 modules
+var logger_middleware = __webpack_require__(8244);
 // EXTERNAL MODULE: external "@nestjs/common"
-var common_ = __webpack_require__(157);
+var common_ = __webpack_require__(6157);
 // EXTERNAL MODULE: external "@nestjs/core"
-var core_ = __webpack_require__(75);
+var core_ = __webpack_require__(3075);
 ;// CONCATENATED MODULE: external "@nestjs/passport"
 
 ;// CONCATENATED MODULE: ./projects/nestjs-shared/src/guards/jwt-auth.guard.ts
@@ -284,9 +381,9 @@ OptionalJwtGuard = optional_jwt_auth_guard_ts_decorate([
 ], OptionalJwtGuard);
 
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/exceptions/permission.exception.ts
-var permission_exception = __webpack_require__(374);
+var permission_exception = __webpack_require__(8374);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/modules/shared-permission-cache/shared-permission-cache.service.ts
-var shared_permission_cache_service = __webpack_require__(657);
+var shared_permission_cache_service = __webpack_require__(4657);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/permission-match.util.ts
 var permission_match_util = __webpack_require__(788);
 ;// CONCATENATED MODULE: ./projects/nestjs-shared/src/guards/permission.guard.ts
@@ -336,13 +433,15 @@ class PermissionGuard {
             context.getHandler(),
             context.getClass()
         ]);
-        if (!permissionConfig) return true;
+        if (permissionConfig === undefined || permissionConfig === null) return true;
         const request = context.switchToHttp().getRequest();
         const user = request.user;
         if (!user) throw new common_.UnauthorizedException({
             message: 'Authentication required',
             messageKey: constants/* .AUTH_MESSAGES.TOKEN_REQUIRED */.mK.TOKEN_REQUIRED
         });
+        const logicNode = this.normalizeToLogicNode(permissionConfig);
+        if (!logicNode) throw new permission_exception/* .InsufficientPermissionsException */.z8([], 'AND');
         if (!this.permissionCacheService?.isCacheConfigured()) {
             throw new permission_exception/* .PermissionSystemUnavailableException */.GS();
         }
@@ -354,8 +453,6 @@ class PermissionGuard {
         if (!userPermissions || userPermissions.length === 0) {
             throw new permission_exception/* .NoPermissionsFoundException */.d$();
         }
-        const logicNode = this.normalizeToLogicNode(permissionConfig);
-        if (!logicNode) return true;
         const result = (0,permission_match_util/* .evaluatePermissionLogic */.Ng)(logicNode, userPermissions);
         if (!result.passed) {
             throw new permission_exception/* .InsufficientPermissionsException */.z8(result.missingPermissions, result.operator);
@@ -363,14 +460,12 @@ class PermissionGuard {
         return true;
     }
     normalizeToLogicNode(config) {
-        // string - single permission
         if (typeof config === 'string') {
             return config ? {
                 type: 'action',
                 actionId: config
             } : null;
         }
-        // string[] - treat as AND of multiple permissions
         if (Array.isArray(config)) {
             if (config.length === 0) return null;
             if (config.length === 1) return {
@@ -386,7 +481,6 @@ class PermissionGuard {
                     }))
             };
         }
-        // SimplePermissionConfig - { permissions: string[], operator: 'AND'|'OR' }
         if ('permissions' in config && Array.isArray(config.permissions)) {
             const simple = config;
             if (simple.permissions.length === 0) return null;
@@ -403,7 +497,6 @@ class PermissionGuard {
                     }))
             };
         }
-        // ILogicNode
         return config;
     }
 }
@@ -426,12 +519,23 @@ PermissionGuard = permission_guard_ts_decorate([
 
 
 },
-657(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(157);
-/* import */ var _classes_hybrid_cache_class_js__rspack_import_1 = __webpack_require__(375);
-/* import */ var _constants_index_js__rspack_import_2 = __webpack_require__(43);
-/* import */ var _exceptions_permission_exception_js__rspack_import_3 = __webpack_require__(374);
-/* import */ var _utils_permission_cache_key_util_js__rspack_import_4 = __webpack_require__(199);
+1647(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+const PERMISSION_RESOLVER = 'PERMISSION_RESOLVER';
+
+__webpack_require__.d(__webpack_exports__, {
+}, {
+  j: PERMISSION_RESOLVER
+});
+
+
+},
+4657(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(6157);
+/* import */ var _classes_hybrid_cache_class_js__rspack_import_1 = __webpack_require__(5375);
+/* import */ var _constants_index_js__rspack_import_2 = __webpack_require__(6043);
+/* import */ var _exceptions_permission_exception_js__rspack_import_3 = __webpack_require__(8374);
+/* import */ var _interfaces_permission_resolver_interface_js__rspack_import_6 = __webpack_require__(1647);
+/* import */ var _utils_permission_cache_key_util_js__rspack_import_4 = __webpack_require__(3199);
 /* import */ var _utils_permission_match_util_js__rspack_import_5 = __webpack_require__(788);
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -462,11 +566,14 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
 class SharedPermissionCacheService {
     cache;
+    resolver;
     config;
-    constructor(cache, config){
+    constructor(cache, config, resolver){
         this.cache = cache;
+        this.resolver = resolver;
         this.config = {
             enableCompanyFeature: false,
             userPermissionKeyFormat: _utils_permission_cache_key_util_js__rspack_import_4/* .DEFAULT_USER_PERMISSION_KEY_FORMAT */.q6,
@@ -474,22 +581,21 @@ class SharedPermissionCacheService {
             ...config
         };
     }
-    /** Read the cached permission codes for a user; empty array when cache is unavailable or unset */ async getPermissions(options) {
+    /** The user's permission codes in a scope: cached, else rebuilt by the resolver; empty when neither has them */ async getPermissions(options) {
         if (!this.cache) return [];
-        const cacheKey = (0,_utils_permission_cache_key_util_js__rspack_import_4/* .buildPermissionCacheKey */.nt)(options, this.config);
+        const cacheKey = await (0,_utils_permission_cache_key_util_js__rspack_import_4/* .resolvePermissionCacheKey */.Rw)(this.cache, options, this.config);
         const cached = await this.cache.get(cacheKey);
-        if (!cached) return [];
-        return Array.isArray(cached) ? cached : cached.backendCodes || [];
+        if (cached) return Array.isArray(cached) ? cached : cached.backendCodes || [];
+        return this.resolver ? this.resolver.getPermissionCodes(options) : [];
     }
     /** Overwrite the cached permission codes for a user with a fixed list */ async setPermissions(options, permissions, ttl) {
         if (!this.cache) return;
-        const cacheKey = (0,_utils_permission_cache_key_util_js__rspack_import_4/* .buildPermissionCacheKey */.nt)(options, this.config);
+        const cacheKey = await (0,_utils_permission_cache_key_util_js__rspack_import_4/* .resolvePermissionCacheKey */.Rw)(this.cache, options, this.config);
         await this.cache.set(cacheKey, permissions, ttl);
     }
-    /** Clear the cached permission codes for a user */ async clearPermissions(options) {
+    /** Clear the cached permission codes of a user - every company and branch scope */ async clearPermissions(options) {
         if (!this.cache) return;
-        const cacheKey = (0,_utils_permission_cache_key_util_js__rspack_import_4/* .buildPermissionCacheKey */.nt)(options, this.config);
-        await this.cache.del(cacheKey);
+        await (0,_utils_permission_cache_key_util_js__rspack_import_4/* .invalidatePermissionCache */.xp)(this.cache, options.userId, this.config);
     }
     /** Check a single permission against the cached list, honoring `*` and `prefix.*` wildcards */ async hasPermission(options, requiredPermission) {
         const permissions = await this.getPermissions(options);
@@ -529,10 +635,13 @@ SharedPermissionCacheService = _ts_decorate([
     _ts_param(0, (0,_nestjs_common__rspack_import_0.Inject)(_constants_index_js__rspack_import_2/* .CACHE_INSTANCE */.zl)),
     _ts_param(1, (0,_nestjs_common__rspack_import_0.Optional)()),
     _ts_param(1, (0,_nestjs_common__rspack_import_0.Inject)(_constants_index_js__rspack_import_2/* .PERMISSION_GUARD_CONFIG */.Lw)),
+    _ts_param(2, (0,_nestjs_common__rspack_import_0.Optional)()),
+    _ts_param(2, (0,_nestjs_common__rspack_import_0.Inject)(_interfaces_permission_resolver_interface_js__rspack_import_6/* .PERMISSION_RESOLVER */.j)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _classes_hybrid_cache_class_js__rspack_import_1/* .HybridCache */.l === "undefined" ? Object : _classes_hybrid_cache_class_js__rspack_import_1/* .HybridCache */.l,
-        typeof PermissionGuardConfig === "undefined" ? Object : PermissionGuardConfig
+        typeof PermissionGuardConfig === "undefined" ? Object : PermissionGuardConfig,
+        typeof IPermissionResolver === "undefined" ? Object : IPermissionResolver
     ])
 ], SharedPermissionCacheService);
 
@@ -542,8 +651,10 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-199(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _constants_index_js__rspack_import_0 = __webpack_require__(43);
+3199(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _constants_index_js__rspack_import_0 = __webpack_require__(6043);
+/* import */ var _middlewares_logger_middleware_js__rspack_import_1 = __webpack_require__(8244);
+
 
 const DEFAULT_USER_PERMISSION_KEY_FORMAT = `${_constants_index_js__rspack_import_0/* .PERMISSIONS_CACHE_PREFIX */.fG}:user:{userId}`;
 const DEFAULT_COMPANY_PERMISSION_KEY_FORMAT = `${_constants_index_js__rspack_import_0/* .PERMISSIONS_CACHE_PREFIX */.fG}:company:{companyId}:branch:{branchId}:user:{userId}`;
@@ -554,9 +665,31 @@ const DEFAULT_COMPANY_PERMISSION_KEY_FORMAT = `${_constants_index_js__rspack_imp
     }
     return (config?.userPermissionKeyFormat || DEFAULT_USER_PERMISSION_KEY_FORMAT).replace('{userId}', options.userId);
 }
+/**
+ * Tenant databases can share user ids (they are cloned from one template), so multi-tenant keys
+ * carry the request's tenant. A single database never does: a stray tenant header must not move
+ * a user onto a cache entry that invalidation never reaches.
+ */ function permissionTenant(config) {
+    return config?.multiTenant ? `tenant:${(0,_middlewares_logger_middleware_js__rspack_import_1/* .getTenantId */.EO)() ?? 'none'}:` : '';
+}
+function permissionStampName(userId, config) {
+    return `${_constants_index_js__rspack_import_0/* .PERMISSIONS_CACHE_PREFIX */.fG}:${permissionTenant(config)}user:${userId}`;
+}
+/**
+ * The key a user's permissions are cached under right now: tenant + scope + the user's version
+ * stamp. Resolve it once, BEFORE reading grants from the database, and write under that same key.
+ */ async function resolvePermissionCacheKey(cache, options, config) {
+    const stamp = await cache.getStamp(permissionStampName(options.userId, config));
+    return `${permissionTenant(config)}${buildPermissionCacheKey(options, config)}:v:${stamp}`;
+}
+/** Drops every cached permission scope (each company and branch) of the user, on every instance */ async function invalidatePermissionCache(cache, userId, config) {
+    await cache.bumpStamp(permissionStampName(userId, config));
+}
 
 __webpack_require__.d(__webpack_exports__, {
-  nt: () => (buildPermissionCacheKey)
+  Rw: () => (resolvePermissionCacheKey),
+  nt: () => (buildPermissionCacheKey),
+  xp: () => (invalidatePermissionCache)
 }, {
   q6: DEFAULT_USER_PERMISSION_KEY_FORMAT,
   s8: DEFAULT_COMPANY_PERMISSION_KEY_FORMAT
@@ -565,7 +698,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 },
 788(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _exceptions_permission_exception_js__rspack_import_0 = __webpack_require__(374);
+/* import */ var _exceptions_permission_exception_js__rspack_import_0 = __webpack_require__(8374);
 
 /** Whether `granted` covers `required`, honoring `*` (everything) and `prefix.*` (everything under prefix) wildcards */ function matchesPermission(granted, required) {
     if (granted.includes(required)) return true;
@@ -646,7 +779,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-75(module) {
+3075(module) {
 
 module.exports = __rspack_external__nestjs_core_d7b00a1a;
 
@@ -656,11 +789,11 @@ module.exports = __rspack_external__nestjs_core_d7b00a1a;
 };
 import { __webpack_require__ } from '../runtime.js';
 var __webpack_exec__ = function(moduleId) { return __webpack_require__(__webpack_require__.s = moduleId); }
-import * as __rspack_chunk_1 from '../948.js';
+import * as __rspack_chunk_1 from '../997.js';
 __webpack_require__.C(__rspack_chunk_1);
 import * as __rspack_chunk_2 from './index.js';
 __webpack_require__.C(__rspack_chunk_2);
-var __webpack_exports__ = __webpack_exec__(510);var __webpack_exports__JwtAuthGuard = __webpack_exports__.TD;
+var __webpack_exports__ = __webpack_exec__(3510);var __webpack_exports__JwtAuthGuard = __webpack_exports__.TD;
 var __webpack_exports__OptionalJwtGuard = __webpack_exports__.Zb;
 var __webpack_exports__PermissionGuard = __webpack_exports__.LQ;
 export { __webpack_exports__JwtAuthGuard as JwtAuthGuard, __webpack_exports__OptionalJwtGuard as OptionalJwtGuard, __webpack_exports__PermissionGuard as PermissionGuard };