@futdevpro/fsm-dynamo 1.20.68 → 1.20.69
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1,6 +1,17 @@
|
|
|
1
1
|
import { DyFM_OperationContext_ControlModel } from '../../_models/control-models/operation-context.control-model';
|
|
2
2
|
import { DyFM_OperationSettings_ControlModel } from '../../_models/control-models/operation-settings.control-model';
|
|
3
3
|
import { DyFM_OperationAuthz_Result } from '../../_models/interfaces/operation-authz-result.interface';
|
|
4
|
+
/**
|
|
5
|
+
* The scope that grants EVERY operation (owner decision D-9, 2026-09-18: "legyen all scope").
|
|
6
|
+
*
|
|
7
|
+
* ⚠️ **What it means, stated plainly:** a key holding this scope passes every scope check — including the
|
|
8
|
+
* checks of operations that DO NOT EXIST YET. A capability added next month is granted to it automatically,
|
|
9
|
+
* with nobody re-approving. That is the deliberate trade of this decision: one token instead of a list.
|
|
10
|
+
*
|
|
11
|
+
* ⛔ It can not collide with a real scope: an operation scope always names a domain and an action
|
|
12
|
+
* (`note:read`), so no declared `apiKeyScope` can ever be this token.
|
|
13
|
+
*/
|
|
14
|
+
export declare const DyFM_operationAllScope: string;
|
|
4
15
|
/**
|
|
5
16
|
* Transport-independent authorization checks of an operation call (HP-DOPL MP-1.4).
|
|
6
17
|
*
|
|
@@ -37,6 +48,13 @@ export declare class DyFM_OperationAuthz_Util {
|
|
|
37
48
|
/** Same as `checkOwnership`, but throws a coded `DyFM_Error` (with `status`) on denial. */
|
|
38
49
|
static assertOwnership(operation: DyFM_OperationSettings_ControlModel<unknown, unknown[], unknown>, ctx: DyFM_OperationContext_ControlModel, target: object): DyFM_OperationAuthz_Result;
|
|
39
50
|
/** Builds a denial result. */
|
|
51
|
+
/**
|
|
52
|
+
* Whether a key's scope list covers the required scope — either exactly, or through the all-scope (D-9).
|
|
53
|
+
*
|
|
54
|
+
* @param scopes - the scopes the key carries
|
|
55
|
+
* @param requiredScope - the scope the operation declares
|
|
56
|
+
*/
|
|
57
|
+
static grantsScope(scopes: string[] | undefined, requiredScope: string): boolean;
|
|
40
58
|
private static deny;
|
|
41
59
|
/** Converts a denial into a thrown `DyFM_Error`; the identity is logged by requestId only. */
|
|
42
60
|
private static throwIfDenied;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"operation-authz.util.d.ts","sourceRoot":"","sources":["../../../src/_collections/utils/operation-authz.util.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kCAAkC,EACnC,MAAM,8DAA8D,CAAC;AAEtE,OAAO,EACL,mCAAmC,EACpC,MAAM,+DAA+D,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AAGvG;;;;;;;;;;;;;GAaG;AACH,qBAAa,wBAAwB;IACnC;;;;OAIG;IACH,MAAM,CAAC,KAAK,CACV,SAAS,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAC3E,GAAG,EAAE,kCAAkC,GACtC,0BAA0B;IAkD7B;;;OAGG;IACH,MAAM,CAAC,MAAM,CACX,SAAS,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAC3E,GAAG,EAAE,kCAAkC,GACtC,0BAA0B;IAM7B;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CACnB,SAAS,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAC3E,GAAG,EAAE,kCAAkC,EACvC,MAAM,EAAE,MAAM,GACb,0BAA0B;IAgC7B,2FAA2F;IAC3F,MAAM,CAAC,eAAe,CACpB,SAAS,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAC3E,GAAG,EAAE,kCAAkC,EACvC,MAAM,EAAE,MAAM,GACb,0BAA0B;IAM7B,8BAA8B;IAC9B,OAAO,CAAC,MAAM,CAAC,IAAI;IAQnB,8FAA8F;IAC9F,OAAO,CAAC,MAAM,CAAC,aAAa;CAsB7B"}
|
|
1
|
+
{"version":3,"file":"operation-authz.util.d.ts","sourceRoot":"","sources":["../../../src/_collections/utils/operation-authz.util.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kCAAkC,EACnC,MAAM,8DAA8D,CAAC;AAEtE,OAAO,EACL,mCAAmC,EACpC,MAAM,+DAA+D,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AAGvG;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAY,CAAC;AAElD;;;;;;;;;;;;;GAaG;AACH,qBAAa,wBAAwB;IACnC;;;;OAIG;IACH,MAAM,CAAC,KAAK,CACV,SAAS,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAC3E,GAAG,EAAE,kCAAkC,GACtC,0BAA0B;IAkD7B;;;OAGG;IACH,MAAM,CAAC,MAAM,CACX,SAAS,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAC3E,GAAG,EAAE,kCAAkC,GACtC,0BAA0B;IAM7B;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CACnB,SAAS,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAC3E,GAAG,EAAE,kCAAkC,EACvC,MAAM,EAAE,MAAM,GACb,0BAA0B;IAgC7B,2FAA2F;IAC3F,MAAM,CAAC,eAAe,CACpB,SAAS,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAC3E,GAAG,EAAE,kCAAkC,EACvC,MAAM,EAAE,MAAM,GACb,0BAA0B;IAM7B,8BAA8B;IAC9B;;;;;OAKG;IACH,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO;IAMhF,OAAO,CAAC,MAAM,CAAC,IAAI;IAQnB,8FAA8F;IAC9F,OAAO,CAAC,MAAM,CAAC,aAAa;CAsB7B"}
|
|
@@ -1,9 +1,20 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.DyFM_OperationAuthz_Util = void 0;
|
|
3
|
+
exports.DyFM_OperationAuthz_Util = exports.DyFM_operationAllScope = void 0;
|
|
4
4
|
const operation_auth_type_enum_1 = require("../../_enums/operation-auth.type-enum");
|
|
5
5
|
const operation_context_control_model_1 = require("../../_models/control-models/operation-context.control-model");
|
|
6
6
|
const error_control_model_1 = require("../../_models/control-models/error.control-model");
|
|
7
|
+
/**
|
|
8
|
+
* The scope that grants EVERY operation (owner decision D-9, 2026-09-18: "legyen all scope").
|
|
9
|
+
*
|
|
10
|
+
* ⚠️ **What it means, stated plainly:** a key holding this scope passes every scope check — including the
|
|
11
|
+
* checks of operations that DO NOT EXIST YET. A capability added next month is granted to it automatically,
|
|
12
|
+
* with nobody re-approving. That is the deliberate trade of this decision: one token instead of a list.
|
|
13
|
+
*
|
|
14
|
+
* ⛔ It can not collide with a real scope: an operation scope always names a domain and an action
|
|
15
|
+
* (`note:read`), so no declared `apiKeyScope` can ever be this token.
|
|
16
|
+
*/
|
|
17
|
+
exports.DyFM_operationAllScope = '*';
|
|
7
18
|
/**
|
|
8
19
|
* Transport-independent authorization checks of an operation call (HP-DOPL MP-1.4).
|
|
9
20
|
*
|
|
@@ -48,8 +59,8 @@ class DyFM_OperationAuthz_Util {
|
|
|
48
59
|
if (!requiredScope) {
|
|
49
60
|
return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-NSC', 403, `operation "${operation?.name}" declares no apiKeyScope, a scoped API key can not call it`, 'This operation can not be called with an API key. Call it with a user token.');
|
|
50
61
|
}
|
|
51
|
-
//
|
|
52
|
-
if (!(ctx.apiKeyScopes
|
|
62
|
+
// the all-scope grants every operation (D-9); otherwise the match is EXACT — a scope is never a prefix
|
|
63
|
+
if (!DyFM_OperationAuthz_Util.grantsScope(ctx.apiKeyScopes, requiredScope)) {
|
|
53
64
|
return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-SCP', 403, `API key lacks scope "${requiredScope}" for operation "${operation?.name}"`, `The API key is missing the "${requiredScope}" scope, which this operation needs. ` +
|
|
54
65
|
'Create a key that has it (an existing key\'s scopes can not be widened).');
|
|
55
66
|
}
|
|
@@ -92,6 +103,16 @@ class DyFM_OperationAuthz_Util {
|
|
|
92
103
|
return DyFM_OperationAuthz_Util.throwIfDenied(DyFM_OperationAuthz_Util.checkOwnership(operation, ctx, target), operation, ctx);
|
|
93
104
|
}
|
|
94
105
|
/** Builds a denial result. */
|
|
106
|
+
/**
|
|
107
|
+
* Whether a key's scope list covers the required scope — either exactly, or through the all-scope (D-9).
|
|
108
|
+
*
|
|
109
|
+
* @param scopes - the scopes the key carries
|
|
110
|
+
* @param requiredScope - the scope the operation declares
|
|
111
|
+
*/
|
|
112
|
+
static grantsScope(scopes, requiredScope) {
|
|
113
|
+
const held = scopes ?? [];
|
|
114
|
+
return held.includes(requiredScope) || held.includes(exports.DyFM_operationAllScope);
|
|
115
|
+
}
|
|
95
116
|
static deny(errorCode, status, reason, userMessage) {
|
|
96
117
|
return {
|
|
97
118
|
allowed: false, errorCode: errorCode, status: status, reason: reason, userMessage: userMessage,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"operation-authz.util.js","sourceRoot":"","sources":["../../../src/_collections/utils/operation-authz.util.ts"],"names":[],"mappings":";;;AAAA,oFAAgF;AAChF,kHAEsE;AACtE,0FAA8E;AAO9E;;;;;;;;;;;;;GAaG;AACH,MAAa,wBAAwB;IACnC;;;;OAIG;IACH,MAAM,CAAC,KAAK,CACV,SAA2E,EAC3E,GAAuC;QAEvC,MAAM,cAAc,GAAY,SAAS,EAAE,KAAK,EAAE,cAAc,KAAK,KAAK,CAAC;QAC3E,MAAM,QAAQ,GAA4B,GAAG,EAAE,QAAQ,IAAI,kDAAuB,CAAC,IAAI,CAAC;QAExF,mEAAmE;QACnE,IAAI,cAAc,IAAI,CAAC,QAAQ,KAAK,kDAAuB,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;YAClF,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EAAE,cAAc,SAAS,EAAE,IAAI,oCAAoC,EACtF,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QAED,mEAAmE;QACnE,IAAI,QAAQ,KAAK,kDAAuB,CAAC,MAAM,EAAE,CAAC;YAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,4FAA4F;QAC5F,IAAI,oEAAkC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;QACtD,CAAC;QAED,MAAM,aAAa,GAAuB,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC;QAExE,mGAAmG;QACnG,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;YACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,6FAA6F;QAC7F,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EACnB,cAAc,SAAS,EAAE,IAAI,6DAA6D,EAC1F,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QAED,
|
|
1
|
+
{"version":3,"file":"operation-authz.util.js","sourceRoot":"","sources":["../../../src/_collections/utils/operation-authz.util.ts"],"names":[],"mappings":";;;AAAA,oFAAgF;AAChF,kHAEsE;AACtE,0FAA8E;AAO9E;;;;;;;;;GASG;AACU,QAAA,sBAAsB,GAAW,GAAG,CAAC;AAElD;;;;;;;;;;;;;GAaG;AACH,MAAa,wBAAwB;IACnC;;;;OAIG;IACH,MAAM,CAAC,KAAK,CACV,SAA2E,EAC3E,GAAuC;QAEvC,MAAM,cAAc,GAAY,SAAS,EAAE,KAAK,EAAE,cAAc,KAAK,KAAK,CAAC;QAC3E,MAAM,QAAQ,GAA4B,GAAG,EAAE,QAAQ,IAAI,kDAAuB,CAAC,IAAI,CAAC;QAExF,mEAAmE;QACnE,IAAI,cAAc,IAAI,CAAC,QAAQ,KAAK,kDAAuB,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;YAClF,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EAAE,cAAc,SAAS,EAAE,IAAI,oCAAoC,EACtF,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QAED,mEAAmE;QACnE,IAAI,QAAQ,KAAK,kDAAuB,CAAC,MAAM,EAAE,CAAC;YAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,4FAA4F;QAC5F,IAAI,oEAAkC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;QACtD,CAAC;QAED,MAAM,aAAa,GAAuB,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC;QAExE,mGAAmG;QACnG,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;YACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,6FAA6F;QAC7F,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EACnB,cAAc,SAAS,EAAE,IAAI,6DAA6D,EAC1F,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QAED,uGAAuG;QACvG,IAAI,CAAC,wBAAwB,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE,CAAC;YAC3E,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EAAE,wBAAwB,aAAa,oBAAoB,SAAS,EAAE,IAAI,GAAG,EAChG,+BAA+B,aAAa,uCAAuC;gBACnF,0EAA0E,CAC3E,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,MAAM,CACX,SAA2E,EAC3E,GAAuC;QAEvC,OAAO,wBAAwB,CAAC,aAAa,CAC3C,wBAAwB,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAC/D,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CACnB,SAA2E,EAC3E,GAAuC,EACvC,MAAc;QAEd,MAAM,cAAc,GAAuB,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC;QAEvE,0CAA0C;QAC1C,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,kFAAkF;QAClF,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC;YACvB,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EACnB,cAAc,SAAS,EAAE,IAAI,8DAA8D,EAC3F,gFAAgF,CACjF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAY,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEhF,mEAAmE;QACnE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,YAAY,EAAE,CAAC;YAChF,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EACnB,gDAAgD,SAAS,EAAE,IAAI,aAAa,cAAc,GAAG;YAC7F,2FAA2F;YAC3F,qCAAqC,CACtC,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,2FAA2F;IAC3F,MAAM,CAAC,eAAe,CACpB,SAA2E,EAC3E,GAAuC,EACvC,MAAc;QAEd,OAAO,wBAAwB,CAAC,aAAa,CAC3C,wBAAwB,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,CAChF,CAAC;IACJ,CAAC;IAED,8BAA8B;IAC9B;;;;;OAKG;IACH,MAAM,CAAC,WAAW,CAAC,MAA4B,EAAE,aAAqB;QACpE,MAAM,IAAI,GAAa,MAAM,IAAI,EAAE,CAAC;QAEpC,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,8BAAsB,CAAC,CAAC;IAC/E,CAAC;IAEO,MAAM,CAAC,IAAI,CACjB,SAAiB,EAAE,MAAiB,EAAE,MAAc,EAAE,WAAmB;QAEzE,OAAO;YACL,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW;SAC/F,CAAC;IACJ,CAAC;IAED,8FAA8F;IACtF,MAAM,CAAC,aAAa,CAC1B,MAAkC,EAClC,SAA2E,EAC3E,GAAuC;QAEvC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,IAAI,gCAAU,CAAC;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,mCAAmC,MAAM,CAAC,MAAM,EAAE;YAC3D,wFAAwF;YACxF,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,iBAAiB,EAAE;gBACjB,SAAS,EAAE,SAAS,EAAE,IAAI;gBAC1B,SAAS,EAAE,GAAG,EAAE,SAAS;gBACzB,QAAQ,EAAE,GAAG,EAAE,QAAQ;aACxB;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAzKD,4DAyKC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@futdevpro/fsm-dynamo",
|
|
3
|
-
"version": "1.20.
|
|
3
|
+
"version": "1.20.69",
|
|
4
4
|
"description": "Full Stack Model Collection for Dynamic (NodeJS-Typescript) Framework called Dynamo, by Future Development Ltd.",
|
|
5
5
|
"DyBu_settings": {
|
|
6
6
|
"packageType": "full-stack-package",
|