@futdevpro/fsm-dynamo 1.20.66 → 1.20.68
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/build/_collections/utils/operation-authz.util.d.ts.map +1 -1
- package/build/_collections/utils/operation-authz.util.js +14 -7
- package/build/_collections/utils/operation-authz.util.js.map +1 -1
- package/build/_collections/utils/operation-schema.util.d.ts +10 -0
- package/build/_collections/utils/operation-schema.util.d.ts.map +1 -1
- package/build/_collections/utils/operation-schema.util.js +26 -0
- package/build/_collections/utils/operation-schema.util.js.map +1 -1
- package/build/_models/interfaces/operation-authz-result.interface.d.ts +7 -0
- package/build/_models/interfaces/operation-authz-result.interface.d.ts.map +1 -1
- package/package.json +1 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"operation-authz.util.d.ts","sourceRoot":"","sources":["../../../src/_collections/utils/operation-authz.util.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kCAAkC,EACnC,MAAM,8DAA8D,CAAC;AAEtE,OAAO,EACL,mCAAmC,EACpC,MAAM,+DAA+D,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AAGvG;;;;;;;;;;;;;GAaG;AACH,qBAAa,wBAAwB;IACnC;;;;OAIG;IACH,MAAM,CAAC,KAAK,CACV,SAAS,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAC3E,GAAG,EAAE,kCAAkC,GACtC,0BAA0B;
|
|
1
|
+
{"version":3,"file":"operation-authz.util.d.ts","sourceRoot":"","sources":["../../../src/_collections/utils/operation-authz.util.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kCAAkC,EACnC,MAAM,8DAA8D,CAAC;AAEtE,OAAO,EACL,mCAAmC,EACpC,MAAM,+DAA+D,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AAGvG;;;;;;;;;;;;;GAaG;AACH,qBAAa,wBAAwB;IACnC;;;;OAIG;IACH,MAAM,CAAC,KAAK,CACV,SAAS,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAC3E,GAAG,EAAE,kCAAkC,GACtC,0BAA0B;IAkD7B;;;OAGG;IACH,MAAM,CAAC,MAAM,CACX,SAAS,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAC3E,GAAG,EAAE,kCAAkC,GACtC,0BAA0B;IAM7B;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CACnB,SAAS,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAC3E,GAAG,EAAE,kCAAkC,EACvC,MAAM,EAAE,MAAM,GACb,0BAA0B;IAgC7B,2FAA2F;IAC3F,MAAM,CAAC,eAAe,CACpB,SAAS,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAC3E,GAAG,EAAE,kCAAkC,EACvC,MAAM,EAAE,MAAM,GACb,0BAA0B;IAM7B,8BAA8B;IAC9B,OAAO,CAAC,MAAM,CAAC,IAAI;IAQnB,8FAA8F;IAC9F,OAAO,CAAC,MAAM,CAAC,aAAa;CAsB7B"}
|
|
@@ -29,7 +29,7 @@ class DyFM_OperationAuthz_Util {
|
|
|
29
29
|
const authKind = ctx?.authKind ?? operation_auth_type_enum_1.DyFM_OperationAuth_Type.none;
|
|
30
30
|
// a missing identity is 401, the caller may retry with credentials
|
|
31
31
|
if (issuerRequired && (authKind === operation_auth_type_enum_1.DyFM_OperationAuth_Type.none || !ctx?.issuer)) {
|
|
32
|
-
return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-UNA', 401, `operation "${operation?.name}" requires an authenticated caller
|
|
32
|
+
return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-UNA', 401, `operation "${operation?.name}" requires an authenticated caller`, 'This operation needs an authenticated caller — send an API key or a token.');
|
|
33
33
|
}
|
|
34
34
|
// scopes only restrict API keys; a token call is not scope-limited
|
|
35
35
|
if (authKind !== operation_auth_type_enum_1.DyFM_OperationAuth_Type.apiKey) {
|
|
@@ -46,11 +46,12 @@ class DyFM_OperationAuthz_Util {
|
|
|
46
46
|
}
|
|
47
47
|
// least privilege: a scoped key can not reach a protected operation that belongs to no scope
|
|
48
48
|
if (!requiredScope) {
|
|
49
|
-
return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-NSC', 403, `operation "${operation?.name}" declares no apiKeyScope, a scoped API key can not call it
|
|
49
|
+
return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-NSC', 403, `operation "${operation?.name}" declares no apiKeyScope, a scoped API key can not call it`, 'This operation can not be called with an API key. Call it with a user token.');
|
|
50
50
|
}
|
|
51
51
|
// exact match only — no wildcard until it is an explicit decision
|
|
52
52
|
if (!(ctx.apiKeyScopes ?? []).includes(requiredScope)) {
|
|
53
|
-
return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-SCP', 403, `API key lacks scope "${requiredScope}" for operation "${operation?.name}"`
|
|
53
|
+
return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-SCP', 403, `API key lacks scope "${requiredScope}" for operation "${operation?.name}"`, `The API key is missing the "${requiredScope}" scope, which this operation needs. ` +
|
|
54
|
+
'Create a key that has it (an existing key\'s scopes can not be widened).');
|
|
54
55
|
}
|
|
55
56
|
return { allowed: true };
|
|
56
57
|
}
|
|
@@ -75,12 +76,14 @@ class DyFM_OperationAuthz_Util {
|
|
|
75
76
|
}
|
|
76
77
|
// a declared ownership check without a caller identity must fail closed, not pass
|
|
77
78
|
if (!ctx?.clientUserId) {
|
|
78
|
-
return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-OWN', 403, `operation "${operation?.name}" requires the caller's clientUserId for the ownership check
|
|
79
|
+
return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-OWN', 403, `operation "${operation?.name}" requires the caller's clientUserId for the ownership check`, 'This operation works on your own data, so it needs to know which user you are.');
|
|
79
80
|
}
|
|
80
81
|
const owner = target ? Reflect.get(target, ownershipField) : undefined;
|
|
81
82
|
// strict equality: an entity without owner is not owned by anybody
|
|
82
83
|
if (owner === undefined || owner === null || String(owner) !== ctx.clientUserId) {
|
|
83
|
-
return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-OWN', 403, `caller does not own the target of operation "${operation?.name}" (field: ${ownershipField})
|
|
84
|
+
return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-OWN', 403, `caller does not own the target of operation "${operation?.name}" (field: ${ownershipField})`,
|
|
85
|
+
// ⛔ the owner and the field name stay inside: the caller only learns that it is not theirs
|
|
86
|
+
'This item belongs to somebody else.');
|
|
84
87
|
}
|
|
85
88
|
return { allowed: true };
|
|
86
89
|
}
|
|
@@ -89,8 +92,10 @@ class DyFM_OperationAuthz_Util {
|
|
|
89
92
|
return DyFM_OperationAuthz_Util.throwIfDenied(DyFM_OperationAuthz_Util.checkOwnership(operation, ctx, target), operation, ctx);
|
|
90
93
|
}
|
|
91
94
|
/** Builds a denial result. */
|
|
92
|
-
static deny(errorCode, status, reason) {
|
|
93
|
-
return {
|
|
95
|
+
static deny(errorCode, status, reason, userMessage) {
|
|
96
|
+
return {
|
|
97
|
+
allowed: false, errorCode: errorCode, status: status, reason: reason, userMessage: userMessage,
|
|
98
|
+
};
|
|
94
99
|
}
|
|
95
100
|
/** Converts a denial into a thrown `DyFM_Error`; the identity is logged by requestId only. */
|
|
96
101
|
static throwIfDenied(result, operation, ctx) {
|
|
@@ -101,6 +106,8 @@ class DyFM_OperationAuthz_Util {
|
|
|
101
106
|
errorCode: result.errorCode,
|
|
102
107
|
status: result.status,
|
|
103
108
|
message: `Operation authorization failed: ${result.reason}`,
|
|
109
|
+
// ⛔ the internal `message` never reaches the caller — this is the text written FOR them
|
|
110
|
+
userMessage: result.userMessage,
|
|
104
111
|
additionalContent: {
|
|
105
112
|
operation: operation?.name,
|
|
106
113
|
requestId: ctx?.requestId,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"operation-authz.util.js","sourceRoot":"","sources":["../../../src/_collections/utils/operation-authz.util.ts"],"names":[],"mappings":";;;AAAA,oFAAgF;AAChF,kHAEsE;AACtE,0FAA8E;AAO9E;;;;;;;;;;;;;GAaG;AACH,MAAa,wBAAwB;IACnC;;;;OAIG;IACH,MAAM,CAAC,KAAK,CACV,SAA2E,EAC3E,GAAuC;QAEvC,MAAM,cAAc,GAAY,SAAS,EAAE,KAAK,EAAE,cAAc,KAAK,KAAK,CAAC;QAC3E,MAAM,QAAQ,GAA4B,GAAG,EAAE,QAAQ,IAAI,kDAAuB,CAAC,IAAI,CAAC;QAExF,mEAAmE;QACnE,IAAI,cAAc,IAAI,CAAC,QAAQ,KAAK,kDAAuB,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;YAClF,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EAAE,cAAc,SAAS,EAAE,IAAI,oCAAoC,
|
|
1
|
+
{"version":3,"file":"operation-authz.util.js","sourceRoot":"","sources":["../../../src/_collections/utils/operation-authz.util.ts"],"names":[],"mappings":";;;AAAA,oFAAgF;AAChF,kHAEsE;AACtE,0FAA8E;AAO9E;;;;;;;;;;;;;GAaG;AACH,MAAa,wBAAwB;IACnC;;;;OAIG;IACH,MAAM,CAAC,KAAK,CACV,SAA2E,EAC3E,GAAuC;QAEvC,MAAM,cAAc,GAAY,SAAS,EAAE,KAAK,EAAE,cAAc,KAAK,KAAK,CAAC;QAC3E,MAAM,QAAQ,GAA4B,GAAG,EAAE,QAAQ,IAAI,kDAAuB,CAAC,IAAI,CAAC;QAExF,mEAAmE;QACnE,IAAI,cAAc,IAAI,CAAC,QAAQ,KAAK,kDAAuB,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;YAClF,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EAAE,cAAc,SAAS,EAAE,IAAI,oCAAoC,EACtF,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QAED,mEAAmE;QACnE,IAAI,QAAQ,KAAK,kDAAuB,CAAC,MAAM,EAAE,CAAC;YAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,4FAA4F;QAC5F,IAAI,oEAAkC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;QACtD,CAAC;QAED,MAAM,aAAa,GAAuB,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC;QAExE,mGAAmG;QACnG,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;YACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,6FAA6F;QAC7F,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EACnB,cAAc,SAAS,EAAE,IAAI,6DAA6D,EAC1F,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACtD,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EAAE,wBAAwB,aAAa,oBAAoB,SAAS,EAAE,IAAI,GAAG,EAChG,+BAA+B,aAAa,uCAAuC;gBACnF,0EAA0E,CAC3E,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,MAAM,CACX,SAA2E,EAC3E,GAAuC;QAEvC,OAAO,wBAAwB,CAAC,aAAa,CAC3C,wBAAwB,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAC/D,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CACnB,SAA2E,EAC3E,GAAuC,EACvC,MAAc;QAEd,MAAM,cAAc,GAAuB,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC;QAEvE,0CAA0C;QAC1C,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,kFAAkF;QAClF,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC;YACvB,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EACnB,cAAc,SAAS,EAAE,IAAI,8DAA8D,EAC3F,gFAAgF,CACjF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAY,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEhF,mEAAmE;QACnE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,YAAY,EAAE,CAAC;YAChF,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EACnB,gDAAgD,SAAS,EAAE,IAAI,aAAa,cAAc,GAAG;YAC7F,2FAA2F;YAC3F,qCAAqC,CACtC,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,2FAA2F;IAC3F,MAAM,CAAC,eAAe,CACpB,SAA2E,EAC3E,GAAuC,EACvC,MAAc;QAEd,OAAO,wBAAwB,CAAC,aAAa,CAC3C,wBAAwB,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,CAChF,CAAC;IACJ,CAAC;IAED,8BAA8B;IACtB,MAAM,CAAC,IAAI,CACjB,SAAiB,EAAE,MAAiB,EAAE,MAAc,EAAE,WAAmB;QAEzE,OAAO;YACL,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW;SAC/F,CAAC;IACJ,CAAC;IAED,8FAA8F;IACtF,MAAM,CAAC,aAAa,CAC1B,MAAkC,EAClC,SAA2E,EAC3E,GAAuC;QAEvC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,IAAI,gCAAU,CAAC;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,mCAAmC,MAAM,CAAC,MAAM,EAAE;YAC3D,wFAAwF;YACxF,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,iBAAiB,EAAE;gBACjB,SAAS,EAAE,SAAS,EAAE,IAAI;gBAC1B,SAAS,EAAE,GAAG,EAAE,SAAS;gBACzB,QAAQ,EAAE,GAAG,EAAE,QAAQ;aACxB;SACF,CAAC,CAAC;IACL,CAAC;CACF;AA7JD,4DA6JC"}
|
|
@@ -5,6 +5,9 @@ import { DyFM_Operation_JsonSchema } from '../../_models/interfaces/operation-js
|
|
|
5
5
|
* Generates the input JSON-schema of an operation (HP-DOPL MP-1.6, DMCP-005) from the runtime data model
|
|
6
6
|
* description (`bodyParams.properties`) — TypeScript generics do not exist at runtime, the properties do.
|
|
7
7
|
* Explicit `inputs` are added on top and override a body property of the same name.
|
|
8
|
+
* The guardrail arguments the operation honours are advertised too (`ifMatch` unless `guardrails.ifMatch` is `none`,
|
|
9
|
+
* required when it is `required`; `dryRun` when `guardrails.dryRun`), so a client that validates against the closed
|
|
10
|
+
* schema can still send them — a declared input of the same name is never overridden.
|
|
8
11
|
*
|
|
9
12
|
* Left out on purpose:
|
|
10
13
|
* - server-managed metadata (every key starting with `_`, e.g. `_id`, `__v`, `__created`);
|
|
@@ -23,6 +26,13 @@ export declare class DyFM_OperationSchema_Util {
|
|
|
23
26
|
* @param operation - the operation description
|
|
24
27
|
*/
|
|
25
28
|
static inputSchema(operation: DyFM_OperationSettings_ControlModel<unknown, unknown[], unknown>): DyFM_Operation_JsonSchema;
|
|
29
|
+
/**
|
|
30
|
+
* Adds the guardrail arguments the operation honours (never over a declared input of the same name).
|
|
31
|
+
* @param operation - the operation description
|
|
32
|
+
* @param properties - the schema properties to extend
|
|
33
|
+
* @param required - the required names to extend
|
|
34
|
+
*/
|
|
35
|
+
private static addGuardrailArgs;
|
|
26
36
|
/**
|
|
27
37
|
* Maps one data property (recursively for objects) to a schema.
|
|
28
38
|
* @param property - the data property params
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"operation-schema.util.d.ts","sourceRoot":"","sources":["../../../src/_collections/utils/operation-schema.util.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"operation-schema.util.d.ts","sourceRoot":"","sources":["../../../src/_collections/utils/operation-schema.util.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,wBAAwB,EACzB,MAAM,iEAAiE,CAAC;AACzE,OAAO,EACL,mCAAmC,EACpC,MAAM,+DAA+D,CAAC;AAEvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0DAA0D,CAAC;AAKrG;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,yBAAyB;IACpC;;;OAGG;IACH,MAAM,CAAC,WAAW,CAChB,SAAS,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,GAC1E,yBAAyB;IAoC5B;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAuB/B;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,yBAAyB;IAiCtG;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,YAAY;IA+B3B,oDAAoD;IACpD,OAAO,CAAC,MAAM,CAAC,mBAAmB;IAkBlC,gEAAgE;IAChE,OAAO,CAAC,MAAM,CAAC,UAAU;IAQzB,8FAA8F;IAC9F,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAO/B,0FAA0F;IAC1F,OAAO,CAAC,MAAM,CAAC,WAAW;CAG3B"}
|
|
@@ -2,11 +2,15 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.DyFM_OperationSchema_Util = void 0;
|
|
4
4
|
const basic_property_type_enum_1 = require("../../_enums/basic-property-type.enum");
|
|
5
|
+
const operation_if_match_type_enum_1 = require("../../_enums/operation-if-match.type-enum");
|
|
5
6
|
const utilities_util_1 = require("./utilities.util");
|
|
6
7
|
/**
|
|
7
8
|
* Generates the input JSON-schema of an operation (HP-DOPL MP-1.6, DMCP-005) from the runtime data model
|
|
8
9
|
* description (`bodyParams.properties`) — TypeScript generics do not exist at runtime, the properties do.
|
|
9
10
|
* Explicit `inputs` are added on top and override a body property of the same name.
|
|
11
|
+
* The guardrail arguments the operation honours are advertised too (`ifMatch` unless `guardrails.ifMatch` is `none`,
|
|
12
|
+
* required when it is `required`; `dryRun` when `guardrails.dryRun`), so a client that validates against the closed
|
|
13
|
+
* schema can still send them — a declared input of the same name is never overridden.
|
|
10
14
|
*
|
|
11
15
|
* Left out on purpose:
|
|
12
16
|
* - server-managed metadata (every key starting with `_`, e.g. `_id`, `__v`, `__created`);
|
|
@@ -39,6 +43,7 @@ class DyFM_OperationSchema_Util {
|
|
|
39
43
|
required.delete(key);
|
|
40
44
|
}
|
|
41
45
|
});
|
|
46
|
+
DyFM_OperationSchema_Util.addGuardrailArgs(operation, properties, required);
|
|
42
47
|
const schema = {
|
|
43
48
|
type: 'object',
|
|
44
49
|
properties: properties,
|
|
@@ -49,6 +54,27 @@ class DyFM_OperationSchema_Util {
|
|
|
49
54
|
}
|
|
50
55
|
return schema;
|
|
51
56
|
}
|
|
57
|
+
/**
|
|
58
|
+
* Adds the guardrail arguments the operation honours (never over a declared input of the same name).
|
|
59
|
+
* @param operation - the operation description
|
|
60
|
+
* @param properties - the schema properties to extend
|
|
61
|
+
* @param required - the required names to extend
|
|
62
|
+
*/
|
|
63
|
+
static addGuardrailArgs(operation, properties, required) {
|
|
64
|
+
const ifMatch = operation?.guardrails?.ifMatch ?? operation_if_match_type_enum_1.DyFM_OperationIfMatch_Type.none;
|
|
65
|
+
if (ifMatch !== operation_if_match_type_enum_1.DyFM_OperationIfMatch_Type.none && !properties.ifMatch) {
|
|
66
|
+
properties.ifMatch = {
|
|
67
|
+
type: 'string',
|
|
68
|
+
description: 'The current etag of the entity; the write is refused when the entity changed since.',
|
|
69
|
+
};
|
|
70
|
+
if (ifMatch === operation_if_match_type_enum_1.DyFM_OperationIfMatch_Type.required) {
|
|
71
|
+
required.add('ifMatch');
|
|
72
|
+
}
|
|
73
|
+
}
|
|
74
|
+
if (operation?.guardrails?.dryRun === true && !properties.dryRun) {
|
|
75
|
+
properties.dryRun = { type: 'boolean', description: 'Validate and preview the change without saving it.' };
|
|
76
|
+
}
|
|
77
|
+
}
|
|
52
78
|
/**
|
|
53
79
|
* Maps one data property (recursively for objects) to a schema.
|
|
54
80
|
* @param property - the data property params
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"operation-schema.util.js","sourceRoot":"","sources":["../../../src/_collections/utils/operation-schema.util.ts"],"names":[],"mappings":";;;AAAA,oFAAgF;
|
|
1
|
+
{"version":3,"file":"operation-schema.util.js","sourceRoot":"","sources":["../../../src/_collections/utils/operation-schema.util.ts"],"names":[],"mappings":";;;AAAA,oFAAgF;AAChF,4FAAuF;AAUvF,qDAA6D;AAG7D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAa,yBAAyB;IACpC;;;OAGG;IACH,MAAM,CAAC,WAAW,CAChB,SAA2E;QAE3E,8DAA8D;QAC9D,MAAM,IAAI,GAA8B,yBAAyB,CAAC,YAAY,CAC5E,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAC/D,CAAC;QACF,MAAM,UAAU,GAAiD,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;QACvF,MAAM,QAAQ,GAAgB,IAAI,GAAG,CAAS,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAEnE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAC7C,CAAC,CAAE,GAAG,EAAE,KAAK,CAA0C,EAAQ,EAAE;YAC/D,UAAU,CAAC,GAAG,CAAC,GAAG,yBAAyB,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAEvE,gEAAgE;YAChE,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC5B,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;QACH,CAAC,CACF,CAAC;QAEF,yBAAyB,CAAC,gBAAgB,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAE5E,MAAM,MAAM,GAA8B;YACxC,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,UAAU;YACtB,oBAAoB,EAAE,KAAK;SAC5B,CAAC;QAEF,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAClB,MAAM,CAAC,QAAQ,GAAG,CAAE,GAAG,QAAQ,CAAE,CAAC;QACpC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,gBAAgB,CAC7B,SAA2E,EAC3E,UAAwD,EACxD,QAAqB;QAErB,MAAM,OAAO,GAA+B,SAAS,EAAE,UAAU,EAAE,OAAO,IAAI,yDAA0B,CAAC,IAAI,CAAC;QAE9G,IAAI,OAAO,KAAK,yDAA0B,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACvE,UAAU,CAAC,OAAO,GAAG;gBACnB,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,qFAAqF;aACnG,CAAC;YAEF,IAAI,OAAO,KAAK,yDAA0B,CAAC,QAAQ,EAAE,CAAC;gBACpD,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,IAAI,SAAS,EAAE,UAAU,EAAE,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACjE,UAAU,CAAC,MAAM,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,oDAAoD,EAAE,CAAC;QAC7G,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,QAAoD;QACxE,MAAM,SAAS,GAA4B,yBAAyB,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjG,MAAM,MAAM,GAA8B,yBAAyB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC1F,mGAAmG;QACnG,MAAM,YAAY,GAAW,MAAM,CAAC,QAAQ,EAAE,YAAY,IAAI,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QAEpF,qBAAqB;QACrB,IAAI,SAAS,KAAK,kDAAuB,CAAC,KAAK,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/E,MAAM,CAAC,KAAK,GAAG,yBAAyB,CAAC,UAAU,CACjD,yBAAyB,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CACjE,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,IAAI,SAAS,KAAK,kDAAuB,CAAC,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;YAC7E,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,QAAQ,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QACpC,CAAC;QAED,IAAI,OAAO,QAAQ,EAAE,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QACxC,CAAC;QAED,IAAI,OAAO,QAAQ,EAAE,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QACxC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,YAAY,CACzB,cAAsF,EACtF,WAAoB;QAEpB,MAAM,UAAU,GAAiD,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,MAAM,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,OAAO,CAC1C,CAAC,CAAE,GAAG,EAAE,QAAQ,CAAwD,EAAQ,EAAE;YAChF,IAAI,GAAG,KAAK,WAAW,IAAI,CAAC,yBAAyB,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACtF,OAAO;YACT,CAAC;YAED,UAAU,CAAC,GAAG,CAAC,GAAG,yBAAyB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAErE,oDAAoD;YACpD,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBACjE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;QACH,CAAC,CACF,CAAC;QAEF,MAAM,MAAM,GAA8B,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;QAElH,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC7B,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,oDAAoD;IAC5C,MAAM,CAAC,mBAAmB,CAAC,KAAmC;QACpE,MAAM,MAAM,GAA8B,yBAAyB,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE3F,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;QACzC,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,GAAG,CAAE,GAAG,KAAK,CAAC,IAAI,CAAE,CAAC;QAClC,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QACjC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,gEAAgE;IACxD,MAAM,CAAC,UAAU,CAAC,IAA6B;QACrD,IAAI,IAAI,KAAK,kDAAuB,CAAC,IAAI,EAAE,CAAC;YAC1C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACjD,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAED,8FAA8F;IACtF,MAAM,CAAC,gBAAgB,CAAC,GAAW,EAAE,QAAoD;QAC/F,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YACzB,QAAQ,EAAE,SAAS,KAAK,IAAI;YAC5B,QAAQ,EAAE,QAAQ,KAAK,IAAI;YAC3B,yBAAyB,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,kDAAuB,CAAC,QAAQ,CAAC;IAC/F,CAAC;IAED,0FAA0F;IAClF,MAAM,CAAC,WAAW,CAAC,IAAwB;QACjD,OAAO,IAAI,CAAC,CAAC,CAAC,IAAA,0CAAyB,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kDAAuB,CAAC,MAAM,CAAC;IACjF,CAAC;CACF;AAzLD,8DAyLC"}
|
|
@@ -17,6 +17,13 @@ export interface DyFM_OperationAuthz_Result {
|
|
|
17
17
|
status?: 401 | 403;
|
|
18
18
|
/** Human-readable reason of the denial. */
|
|
19
19
|
reason?: string;
|
|
20
|
+
/**
|
|
21
|
+
* What the CALLER is told (HP-DOPL MP-5 closing review). The internal `reason` never leaves the server, so
|
|
22
|
+
* without this the caller only sees a generic text with the error code — and a key-based integration would
|
|
23
|
+
* not learn the ONE actionable fact: which scope it is missing. The scope name is part of the operation's
|
|
24
|
+
* own contract, not a secret (this is what `WWW-Authenticate: scope="…"` does).
|
|
25
|
+
*/
|
|
26
|
+
userMessage?: string;
|
|
20
27
|
/** Set when the call is allowed only through the legacy, scope-less API key path (D-6). */
|
|
21
28
|
warning?: 'legacy-api-key';
|
|
22
29
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"operation-authz-result.interface.d.ts","sourceRoot":"","sources":["../../../src/_models/interfaces/operation-authz-result.interface.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4FAA4F;IAC5F,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IACnB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B"}
|
|
1
|
+
{"version":3,"file":"operation-authz-result.interface.d.ts","sourceRoot":"","sources":["../../../src/_models/interfaces/operation-authz-result.interface.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4FAA4F;IAC5F,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IACnB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@futdevpro/fsm-dynamo",
|
|
3
|
-
"version": "1.20.
|
|
3
|
+
"version": "1.20.68",
|
|
4
4
|
"description": "Full Stack Model Collection for Dynamic (NodeJS-Typescript) Framework called Dynamo, by Future Development Ltd.",
|
|
5
5
|
"DyBu_settings": {
|
|
6
6
|
"packageType": "full-stack-package",
|