@gadmin2n/schematics 0.0.139 → 0.0.140

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/integrationConnection/integration-connection.dto.ts

@@ -0,0 +1,98 @@
+import { Type } from 'class-transformer';
+import {
+  IsBoolean,
+  IsEnum,
+  IsInt,
+  IsNotEmpty,
+  IsObject,
+  IsOptional,
+  IsString,
+  MaxLength,
+  Min,
+} from 'class-validator';
+
+export enum IntegrationAuthTypeDto {
+  NONE = 'NONE',
+  BASIC = 'BASIC',
+  BEARER = 'BEARER',
+  API_KEY = 'API_KEY',
+}
+
+export class CreateIntegrationConnectionDto {
+  @IsOptional()
+  @IsString()
+  @IsNotEmpty()
+  @MaxLength(64)
+  code?: string;
+
+  @IsString()
+  @IsNotEmpty()
+  @MaxLength(128)
+  name!: string;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(512)
+  description?: string;
+
+  @IsString()
+  @IsNotEmpty()
+  @MaxLength(1024)
+  baseUrl!: string;
+
+  @IsEnum(IntegrationAuthTypeDto)
+  authType!: IntegrationAuthTypeDto;
+
+  @IsOptional()
+  @IsObject()
+  publicConfig?: Record<string, unknown>;
+
+  @IsOptional()
+  @IsObject()
+  secretConfig?: Record<string, unknown>;
+
+  @IsOptional()
+  @IsBoolean()
+  isEnabled?: boolean;
+}
+
+export class UpdateIntegrationConnectionDto {
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  expectedRevision!: number;
+
+  @IsOptional()
+  @IsString()
+  @IsNotEmpty()
+  @MaxLength(128)
+  name?: string;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(512)
+  description?: string | null;
+
+  @IsOptional()
+  @IsString()
+  @IsNotEmpty()
+  @MaxLength(1024)
+  baseUrl?: string;
+
+  @IsOptional()
+  @IsEnum(IntegrationAuthTypeDto)
+  authType?: IntegrationAuthTypeDto;
+
+  @IsOptional()
+  @IsObject()
+  publicConfig?: Record<string, unknown>;
+
+  // Omit this field to preserve the currently stored secret.
+  @IsOptional()
+  @IsObject()
+  secretConfig?: Record<string, unknown>;
+
+  @IsOptional()
+  @IsBoolean()
+  isEnabled?: boolean;
+}

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/integrationConnection/integration-connection.service.ts

@@ -0,0 +1,277 @@
+import {
+  BadRequestException,
+  ConflictException,
+  Injectable,
+  NotFoundException,
+  ServiceUnavailableException,
+} from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import {
+  IntegrationAuthType,
+  IntegrationConnection,
+  Prisma,
+} from '@prisma/client';
+import { PrismaService } from 'nestjs-prisma';
+import { ActorContext } from '../subjectProvider/subject-provider.types';
+import {
+  CreateIntegrationConnectionDto,
+  UpdateIntegrationConnectionDto,
+} from './integration-connection.dto';
+import { IntegrationSecretCipher } from './integration-secret-cipher';
+
+@Injectable()
+export class IntegrationConnectionService {
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly config: ConfigService,
+  ) {}
+
+  async list(query = '') {
+    const entities = await this.prisma.integrationConnection.findMany({
+      where: query
+        ? {
+            OR: [
+              { name: { contains: query, mode: 'insensitive' } },
+              { code: { contains: query, mode: 'insensitive' } },
+            ],
+          }
+        : undefined,
+      orderBy: [{ isEnabled: 'desc' }, { updatedAt: 'desc' }],
+    });
+    return entities.map((entity) => this.toPublic(entity));
+  }
+
+  async get(code: string) {
+    const entity = await this.findOrThrow(code);
+    return this.toPublic(entity);
+  }
+
+  async create(input: CreateIntegrationConnectionDto, actor: ActorContext) {
+    const authType = input.authType as IntegrationAuthType;
+    const baseUrl = normalizeBaseUrl(input.baseUrl);
+    const publicConfig = normalizePublicConfig(authType, input.publicConfig);
+    const encryptedSecrets = this.encryptSecrets(
+      authType,
+      input.secretConfig,
+      false,
+    );
+    try {
+      const entity = await this.prisma.integrationConnection.create({
+        data: {
+          ...(input.code && { code: input.code.trim() }),
+          name: input.name.trim(),
+          description: input.description?.trim() || null,
+          baseUrl,
+          authType,
+          publicConfig: publicConfig as Prisma.InputJsonValue,
+          encryptedSecrets,
+          isEnabled: input.isEnabled ?? true,
+          creator: this.creatorFrom(actor),
+        },
+      });
+      return this.toPublic(entity);
+    } catch (error) {
+      if (
+        error instanceof Prisma.PrismaClientKnownRequestError &&
+        error.code === 'P2002'
+      )
+        throw new ConflictException('Connection code already exists');
+      throw error;
+    }
+  }
+
+  async update(
+    code: string,
+    input: UpdateIntegrationConnectionDto,
+    _actor: ActorContext,
+  ) {
+    const current = await this.findOrThrow(code);
+    const authType = (input.authType ??
+      current.authType) as IntegrationAuthType;
+    const publicConfig = normalizePublicConfig(
+      authType,
+      input.publicConfig ?? asObject(current.publicConfig),
+    );
+    let encryptedSecrets = current.encryptedSecrets;
+    if (authType === 'NONE') encryptedSecrets = null;
+    else if (input.secretConfig !== undefined)
+      encryptedSecrets = this.encryptSecrets(
+        authType,
+        input.secretConfig,
+        false,
+      );
+    else if (authType !== current.authType)
+      throw new BadRequestException(
+        'Secret credentials are required when changing authentication type',
+      );
+
+    const result = await this.prisma.integrationConnection.updateMany({
+      where: { code, revision: input.expectedRevision },
+      data: {
+        ...(input.name !== undefined && { name: input.name.trim() }),
+        ...(input.description !== undefined && {
+          description: input.description?.trim() || null,
+        }),
+        ...(input.baseUrl !== undefined && {
+          baseUrl: normalizeBaseUrl(input.baseUrl),
+        }),
+        authType,
+        publicConfig: publicConfig as Prisma.InputJsonValue,
+        encryptedSecrets,
+        ...(input.isEnabled !== undefined && { isEnabled: input.isEnabled }),
+        revision: { increment: 1 },
+      },
+    });
+    if (!result.count)
+      throw new ConflictException(
+        'Connection was updated by someone else; reload and try again',
+      );
+    return this.get(code);
+  }
+
+  async resolveRuntime(code: string) {
+    const entity = await this.findOrThrow(code);
+    if (!entity.isEnabled)
+      throw new BadRequestException({
+        code: 'INTEGRATION_CONNECTION_DISABLED',
+        message: `Connection ${code} is disabled`,
+        retryable: false,
+      });
+    return {
+      code: entity.code,
+      revision: entity.revision,
+      baseUrl: entity.baseUrl,
+      authType: entity.authType,
+      publicConfig: asObject(entity.publicConfig),
+      secrets: entity.encryptedSecrets
+        ? this.getCipher().decrypt(entity.encryptedSecrets)
+        : {},
+    };
+  }
+
+  private async findOrThrow(code: string) {
+    const entity = await this.prisma.integrationConnection.findUnique({
+      where: { code },
+    });
+    if (!entity) throw new NotFoundException('Connection not found');
+    return entity;
+  }
+
+  private encryptSecrets(
+    authType: IntegrationAuthType,
+    value: Record<string, unknown> | undefined,
+    allowEmpty: boolean,
+  ): string | null {
+    if (authType === 'NONE') return null;
+    const secrets = value ?? {};
+    const required =
+      authType === 'BASIC'
+        ? ['username', 'password']
+        : authType === 'BEARER'
+        ? ['token']
+        : ['apiKey'];
+    if (
+      !allowEmpty &&
+      required.some((key) => typeof secrets[key] !== 'string' || !secrets[key])
+    )
+      throw new BadRequestException(
+        `Missing connection secret: ${required.join(', ')}`,
+      );
+    return this.getCipher().encrypt(secrets);
+  }
+
+  private getCipher(): IntegrationSecretCipher {
+    const key =
+      this.config.get<string>('integration.secretKey') ??
+      process.env.INTEGRATION_SECRET_KEY ??
+      '';
+    try {
+      return new IntegrationSecretCipher(key);
+    } catch (error) {
+      throw new ServiceUnavailableException({
+        code: 'INTEGRATION_SECRET_KEY_INVALID',
+        message:
+          error instanceof Error
+            ? error.message
+            : 'Integration secret encryption is unavailable',
+      });
+    }
+  }
+
+  private toPublic(entity: IntegrationConnection) {
+    return {
+      id: String(entity.id),
+      code: entity.code,
+      name: entity.name,
+      description: entity.description,
+      type: entity.type,
+      baseUrl: entity.baseUrl,
+      authType: entity.authType,
+      publicConfig: entity.publicConfig,
+      hasSecret: Boolean(entity.encryptedSecrets),
+      isEnabled: entity.isEnabled,
+      revision: entity.revision,
+      creator: entity.creator,
+      createdAt: entity.createdAt,
+      updatedAt: entity.updatedAt,
+    };
+  }
+
+  private creatorFrom(actor: ActorContext): string {
+    return actor.username ?? actor.userId;
+  }
+}
+
+function normalizeBaseUrl(value: string): string {
+  try {
+    const url = new URL(value.trim());
+    if (!['http:', 'https:'].includes(url.protocol)) throw new Error();
+    url.hash = '';
+    url.search = '';
+    return url.toString().replace(/\/$/, '');
+  } catch {
+    throw new BadRequestException('Connection base URL must be HTTP or HTTPS');
+  }
+}
+
+function normalizePublicConfig(
+  authType: IntegrationAuthType,
+  input: Record<string, unknown> | undefined,
+): Record<string, unknown> {
+  const value = input ?? {};
+  if (
+    value.defaultHeaders !== undefined &&
+    !isStringRecord(value.defaultHeaders)
+  )
+    throw new BadRequestException('Default headers must contain string values');
+  if (authType === 'API_KEY') {
+    if (value.signatureType === 'TENCENT_TOF') {
+      if (typeof value.paasId !== 'string' || !value.paasId.trim())
+        throw new BadRequestException('Tencent TOF PAAS ID is required');
+    } else if (typeof value.apiKeyName !== 'string' || !value.apiKeyName.trim())
+      throw new BadRequestException('API key name is required');
+    if (
+      value.apiKeyLocation !== undefined &&
+      !['HEADER', 'QUERY'].includes(String(value.apiKeyLocation))
+    )
+      throw new BadRequestException('API key location must be HEADER or QUERY');
+  }
+  return value;
+}
+
+function isStringRecord(value: unknown): boolean {
+  return (
+    Boolean(value) &&
+    typeof value === 'object' &&
+    !Array.isArray(value) &&
+    Object.values(value as Record<string, unknown>).every(
+      (item) => typeof item === 'string',
+    )
+  );
+}
+
+function asObject(value: Prisma.JsonValue): Record<string, unknown> {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : {};
+}

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/integrationConnection/integration-secret-cipher.spec.ts

@@ -0,0 +1,14 @@
+import { IntegrationSecretCipher } from './integration-secret-cipher';
+
+describe('IntegrationSecretCipher', () => {
+  it('encrypts connection secrets without storing their plaintext', () => {
+    const key = Buffer.alloc(32, 7).toString('base64');
+    const cipher = new IntegrationSecretCipher(key);
+    const secret = { token: 'very-secret-token', clientSecret: 'hidden' };
+
+    const encrypted = cipher.encrypt(secret);
+
+    expect(encrypted).not.toContain(secret.token);
+    expect(cipher.decrypt(encrypted)).toEqual(secret);
+  });
+});

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/integrationConnection/integration-secret-cipher.ts

@@ -0,0 +1,59 @@
+import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
+
+const VERSION = 'v1';
+
+export class IntegrationSecretCipher {
+  private readonly key: Buffer;
+
+  constructor(encodedKey: string) {
+    this.key = decodeKey(encodedKey);
+  }
+
+  encrypt(value: Record<string, unknown>): string {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', this.key, iv);
+    const ciphertext = Buffer.concat([
+      cipher.update(JSON.stringify(value), 'utf8'),
+      cipher.final(),
+    ]);
+    const tag = cipher.getAuthTag();
+    return [VERSION, iv, tag, ciphertext]
+      .map((part) =>
+        typeof part === 'string' ? part : part.toString('base64'),
+      )
+      .join(':');
+  }
+
+  decrypt(payload: string | null | undefined): Record<string, unknown> {
+    if (!payload) return {};
+    const [version, iv, tag, ciphertext, extra] = payload.split(':');
+    if (version !== VERSION || !iv || !tag || !ciphertext || extra)
+      throw new Error('INTEGRATION_SECRET_PAYLOAD_INVALID');
+    const decipher = createDecipheriv(
+      'aes-256-gcm',
+      this.key,
+      Buffer.from(iv, 'base64'),
+    );
+    decipher.setAuthTag(Buffer.from(tag, 'base64'));
+    const plaintext = Buffer.concat([
+      decipher.update(Buffer.from(ciphertext, 'base64')),
+      decipher.final(),
+    ]).toString('utf8');
+    const parsed = JSON.parse(plaintext);
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+      throw new Error('INTEGRATION_SECRET_PAYLOAD_INVALID');
+    return parsed as Record<string, unknown>;
+  }
+}
+
+function decodeKey(value: string): Buffer {
+  const trimmed = value.trim();
+  const key = /^[a-f0-9]{64}$/i.test(trimmed)
+    ? Buffer.from(trimmed, 'hex')
+    : Buffer.from(trimmed, 'base64');
+  if (key.length !== 32)
+    throw new Error(
+      'INTEGRATION_SECRET_KEY must be a 32-byte base64 value or 64 hexadecimal characters',
+    );
+  return key;
+}

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/integrationConnection/integrationConnection.module.ts

@@ -0,0 +1,10 @@
+import { Module } from '@nestjs/common';
+import { IntegrationConnectionController } from './integration-connection.controller';
+import { IntegrationConnectionService } from './integration-connection.service';
+
+@Module({
+  controllers: [IntegrationConnectionController],
+  providers: [IntegrationConnectionService],
+  exports: [IntegrationConnectionService],
+})
+export class IntegrationConnectionModule {}

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/subjectProvider/actor-context.util.ts

@@ -0,0 +1,27 @@
+import { UserType } from '@gadmin2n/nest-common';
+import { Request } from 'express';
+import { ActorContext } from './subject-provider.types';
+
+type HydratedActorUser = UserType & {
+  configPerms?: { roles?: readonly string[] };
+};
+
+export type AuthenticatedActorRequest = Request & {
+  user: HydratedActorUser;
+};
+
+export function actorContextFromRequest(
+  request: AuthenticatedActorRequest,
+): ActorContext {
+  const { user } = request;
+  const permissions = Object.entries(user.permissions ?? {})
+    .filter(([, permission]) => permission.granted)
+    .map(([key]) => key);
+
+  return {
+    userId: String(user.userid ?? user.username),
+    ...(user.username && { username: user.username }),
+    roles: [...(user.configPerms?.roles ?? [])],
+    permissions,
+  };
+}

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/subjectProvider/providers/user-group.provider.ts

@@ -0,0 +1,208 @@
+import { Injectable } from '@nestjs/common';
+import { UserGroupDomainError } from '../../userGroup/user-group.errors';
+import { UserGroupService } from '../../userGroup/user-group.service';
+import { SubjectProviderUnavailableError } from '../subject-provider.errors';
+import {
+  ActorContext,
+  ProviderValidationIssue,
+  ResolveContext,
+  ResolvedPrincipal,
+  SubjectPreview,
+  SubjectProvider,
+  SubjectProviderDescriptor,
+  SubjectResource,
+} from '../subject-provider.types';
+
+type CreateInput = {
+  name: string;
+  description?: string;
+  userRefs?: string[];
+  childGroupRefs?: string[];
+  code?: string;
+};
+
+@Injectable()
+export class UserGroupProvider implements SubjectProvider {
+  readonly key = 'USER_GROUP';
+  constructor(private readonly groups: UserGroupService) {}
+
+  descriptor(_actor: ActorContext): SubjectProviderDescriptor {
+    return {
+      key: this.key,
+      label: 'User groups',
+      referenceFormat: 'STRING',
+      principalType: 'USER',
+      capabilities: {
+        search: true,
+        preview: true,
+        inlineCreate: true,
+        edit: true,
+        emitsChanges: true,
+      },
+      createSchema: {
+        type: 'object',
+        required: ['name'],
+        properties: {
+          code: { type: 'string' },
+          name: { type: 'string' },
+          description: { type: 'string' },
+          userRefs: { type: 'array', items: { type: 'string' } },
+          childGroupRefs: { type: 'array', items: { type: 'string' } },
+        },
+      },
+    };
+  }
+
+  async search(
+    query: string,
+    _actor: ActorContext,
+  ): Promise<SubjectResource[]> {
+    try {
+      return (await this.groups.search(query)).map((group) => ({
+        ref: group.code,
+        label: group.name,
+        ...(group.description ? { description: group.description } : {}),
+        active: true,
+        revision: group.revision,
+      }));
+    } catch (error) {
+      if (error instanceof UserGroupDomainError) throw error;
+      throw new SubjectProviderUnavailableError(this.key);
+    }
+  }
+
+  async create(
+    input: Record<string, unknown>,
+    actor: ActorContext,
+  ): Promise<SubjectResource> {
+    const value = input as CreateInput;
+    try {
+      const group = await this.groups.createGroup(
+        {
+          name: value.name,
+          ...(value.code !== undefined ? { code: value.code } : {}),
+          ...(value.description !== undefined
+            ? { description: value.description }
+            : {}),
+          userIds: value.userRefs ?? [],
+          childGroupCodes: value.childGroupRefs ?? [],
+        },
+        actor,
+      );
+      return {
+        ref: group.code,
+        label: group.name,
+        ...(group.description ? { description: group.description } : {}),
+        active: group.isActive,
+        revision: group.revision,
+      };
+    } catch (error) {
+      if (error instanceof UserGroupDomainError) throw error;
+      throw new SubjectProviderUnavailableError(this.key);
+    }
+  }
+
+  async validate(refs: string[]) {
+    const { unique, duplicates } = this.normalize(refs);
+    const issues: ProviderValidationIssue[] = duplicates.map((ref) => ({
+      ref,
+      code: 'DUPLICATE_REF',
+      message: `Duplicate user group reference: ${ref}`,
+    }));
+    for (const ref of unique) {
+      try {
+        const group = await this.groups.preview(ref);
+        if (!group.isActive)
+          issues.push({
+            ref,
+            code: 'INACTIVE',
+            message: `User group is inactive: ${ref}`,
+          });
+      } catch (error) {
+        if (!(error instanceof UserGroupDomainError))
+          throw new SubjectProviderUnavailableError(this.key);
+        const response = error.getResponse();
+        const detail =
+          typeof response === 'object'
+            ? (response as { code?: string; message?: string })
+            : {};
+        issues.push({
+          ref,
+          code: detail.code ?? 'NOT_FOUND',
+          message: detail.message ?? `Invalid user group: ${ref}`,
+        });
+      }
+    }
+    return { valid: issues.length === 0, ...(issues.length ? { issues } : {}) };
+  }
+
+  async preview(refs: string[]): Promise<SubjectPreview> {
+    try {
+      const groups = await Promise.all(
+        this.normalize(refs).unique.map((ref) => this.groups.preview(ref)),
+      );
+      return {
+        items: groups.map((group) => ({
+          ref: group.code,
+          label: group.name,
+          ...(group.description ? { description: group.description } : {}),
+          active: group.isActive,
+          revision: group.revision,
+          metadata: { resolvedUserCount: group.resolvedUserCount },
+          principals: group.users.map((user) =>
+            this.principal(user, group.code),
+          ),
+        })),
+      };
+    } catch (error) {
+      if (error instanceof UserGroupDomainError) throw error;
+      throw new SubjectProviderUnavailableError(this.key);
+    }
+  }
+
+  async resolve(
+    refs: string[],
+    _context: ResolveContext,
+  ): Promise<ResolvedPrincipal[]> {
+    const principals = new Map<string, ResolvedPrincipal>();
+    try {
+      for (const ref of this.normalize(refs).unique) {
+        for (const user of await this.groups.resolveUsers(ref)) {
+          const current = principals.get(user.userid);
+          principals.set(
+            user.userid,
+            current
+              ? { ...current, sourceRefs: [...current.sourceRefs, ref].sort() }
+              : this.principal(user, ref),
+          );
+        }
+      }
+    } catch {
+      throw new SubjectProviderUnavailableError(this.key);
+    }
+    return [...principals.values()].sort((a, b) =>
+      a.principalRef.localeCompare(b.principalRef),
+    );
+  }
+
+  private principal(
+    user: { userid: string; username: string | null },
+    sourceRef: string,
+  ): ResolvedPrincipal {
+    return {
+      principalType: 'USER',
+      principalRef: user.userid,
+      displayName: user.username ?? user.userid,
+      sourceRefs: [sourceRef],
+    };
+  }
+
+  private normalize(refs: string[]) {
+    const seen = new Set<string>(),
+      duplicateSet = new Set<string>();
+    const unique: string[] = [];
+    for (const ref of refs)
+      seen.has(ref) ? duplicateSet.add(ref) : (seen.add(ref), unique.push(ref));
+    return { unique, duplicates: [...duplicateSet] };
+  }
+}