@gadmin2n/schematics 0.0.157 → 0.0.158

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/canvas/canvas.controller.ts

@@ -18,6 +18,7 @@ import { ApiTags } from '@nestjs/swagger';
 import { UseRoles } from 'nest-access-control';
 import { PrismaService } from 'nestjs-prisma';
 import { AllowUnauthorizedRequest } from '../../lib/auth.guard';
+import { AllowTransferExportRequest } from '../permTransfer/transfer-export.decorator';
 import { ImportPayloadDto } from './canvas-export.dto';
 import { CanvasExportService } from './canvas-export.service';
 import {
@@ -149,7 +150,7 @@ export class CanvasController {
   }
 
   @Get('export/:code')
-  @AllowUnauthorizedRequest()
+  @AllowTransferExportRequest()
   async getExportPayload(
     @Param('code') code: string,
     @Query('token') token: string,

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/page/page.controller.ts

@@ -46,9 +46,9 @@ import {
 } from '../../generated/page/dto/page-types.dto';
 import { UpdatePageDto } from '../../generated/page/dto/update-page.dto';
 import { PageEntity } from '../../generated/page/entities/page.entity';
-import { AllowUnauthorizedRequest } from '../../lib/auth.guard';
 import { PageTransferService } from '../permTransfer/page-transfer.service';
 import { ImportPayloadDto } from '../permTransfer/perm-transfer.dto';
+import { AllowTransferExportRequest } from '../permTransfer/transfer-export.decorator';
 import { PageService } from './page.service';
 
 import { ConfigService } from '@nestjs/config';
@@ -248,7 +248,7 @@ export class PageController {
   }
 
   @Get('export/:code')
-  @AllowUnauthorizedRequest()
+  @AllowTransferExportRequest()
   async getExportPayload(
     @Param('code') code: string,
     @Query('token') token: string,

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/permTransfer/transfer-export.decorator.spec.ts

@@ -0,0 +1,34 @@
+import { setCredentialedExportCorsHeaders } from './transfer-export.decorator';
+
+describe('setCredentialedExportCorsHeaders', () => {
+  it('reflects the request origin for credentialed export responses', () => {
+    const response = {
+      setHeader: jest.fn(),
+      vary: jest.fn(),
+    };
+
+    setCredentialedExportCorsHeaders('https://target.example.com', response);
+
+    expect(response.setHeader).toHaveBeenCalledWith(
+      'Access-Control-Allow-Origin',
+      'https://target.example.com',
+    );
+    expect(response.setHeader).toHaveBeenCalledWith(
+      'Access-Control-Allow-Credentials',
+      'true',
+    );
+    expect(response.vary).toHaveBeenCalledWith('Origin');
+  });
+
+  it('leaves non-browser responses unchanged when Origin is absent', () => {
+    const response = {
+      setHeader: jest.fn(),
+      vary: jest.fn(),
+    };
+
+    setCredentialedExportCorsHeaders(undefined, response);
+
+    expect(response.setHeader).not.toHaveBeenCalled();
+    expect(response.vary).not.toHaveBeenCalled();
+  });
+});

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/permTransfer/transfer-export.decorator.ts

@@ -0,0 +1,42 @@
+import {
+  applyDecorators,
+  NestInterceptor,
+  UseInterceptors,
+} from '@nestjs/common';
+import { AllowUnauthorizedRequest } from '../../lib/auth.guard';
+
+interface CorsResponse {
+  setHeader(name: string, value: string): unknown;
+  vary(field: string): unknown;
+}
+
+export function setCredentialedExportCorsHeaders(
+  origin: unknown,
+  response: CorsResponse,
+): void {
+  if (typeof origin !== 'string' || !origin) return;
+
+  response.setHeader('Access-Control-Allow-Origin', origin);
+  response.setHeader('Access-Control-Allow-Credentials', 'true');
+  response.vary('Origin');
+}
+
+const credentialedExportCorsInterceptor: NestInterceptor = {
+  intercept(context, next) {
+    const request = context.switchToHttp().getRequest();
+    const response = context.switchToHttp().getResponse();
+
+    setCredentialedExportCorsHeaders(request.headers.origin, response);
+    return next.handle();
+  },
+};
+
+/**
+ * Public export endpoints authenticate with their short-lived transfer token,
+ * while the browser may include its gateway cookie from any deployment origin.
+ */
+export const AllowTransferExportRequest = () =>
+  applyDecorators(
+    AllowUnauthorizedRequest(),
+    UseInterceptors(credentialedExportCorsInterceptor),
+  );

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/resource/resource.controller.ts

@@ -46,9 +46,9 @@ import {
 } from '../../generated/resource/dto/resource-types.dto';
 import { UpdateResourceDto } from '../../generated/resource/dto/update-resource.dto';
 import { ResourceEntity } from '../../generated/resource/entities/resource.entity';
-import { AllowUnauthorizedRequest } from '../../lib/auth.guard';
 import { ImportPayloadDto } from '../permTransfer/perm-transfer.dto';
 import { ResourceTransferService } from '../permTransfer/resource-transfer.service';
+import { AllowTransferExportRequest } from '../permTransfer/transfer-export.decorator';
 import { ResourceService } from './resource.service';
 
 import { ConfigService } from '@nestjs/config';
@@ -194,7 +194,7 @@ export class ResourceController {
   }
 
   @Get('export/:code')
-  @AllowUnauthorizedRequest()
+  @AllowTransferExportRequest()
   async getExportPayload(
     @Param('code') code: string,
     @Query('token') token: string,

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/role/role.controller.ts

@@ -46,9 +46,9 @@ import {
 } from '../../generated/role/dto/role-types.dto';
 import { UpdateRoleDto } from '../../generated/role/dto/update-role.dto';
 import { RoleEntity } from '../../generated/role/entities/role.entity';
-import { AllowUnauthorizedRequest } from '../../lib/auth.guard';
 import { ImportPayloadDto } from '../permTransfer/perm-transfer.dto';
 import { RoleTransferService } from '../permTransfer/role-transfer.service';
+import { AllowTransferExportRequest } from '../permTransfer/transfer-export.decorator';
 import { RoleService } from './role.service';
 
 import { ConfigService } from '@nestjs/config';
@@ -208,7 +208,7 @@ export class RoleController {
   }
 
   @Get('export/:name')
-  @AllowUnauthorizedRequest()
+  @AllowTransferExportRequest()
   async getExportPayload(
     @Param('name') name: string,
     @Query('token') token: string,

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/user/user.controller.ts

@@ -46,8 +46,8 @@ import {
   UserWhereSelect,
 } from '../../generated/user/dto/user-types.dto';
 import { UserEntity } from '../../generated/user/entities/user.entity';
-import { AllowUnauthorizedRequest } from '../../lib/auth.guard';
 import { ImportPayloadDto } from '../permTransfer/perm-transfer.dto';
+import { AllowTransferExportRequest } from '../permTransfer/transfer-export.decorator';
 import { UserTransferService } from '../permTransfer/user-transfer.service';
 import { UserService } from './user.service';
 
@@ -207,7 +207,7 @@ export class UserController {
   }
 
   @Get('export/:userid')
-  @AllowUnauthorizedRequest()
+  @AllowTransferExportRequest()
   async getExportPayload(
     @Param('userid') userid: string,
     @Query('token') token: string,

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/userGroup/require-user-group.decorator.spec.ts

@@ -0,0 +1,23 @@
+import {
+  REQUIRED_USER_GROUP_KEY,
+  RequireUserGroup,
+} from './require-user-group.decorator';
+
+describe('RequireUserGroup', () => {
+  it('stores a normalized group code as route metadata', () => {
+    class Controller {
+      @RequireUserGroup('  it_ops  ')
+      create() {}
+    }
+
+    expect(
+      Reflect.getMetadata(REQUIRED_USER_GROUP_KEY, Controller.prototype.create),
+    ).toBe('it_ops');
+  });
+
+  it('rejects an empty group code instead of disabling authorization', () => {
+    expect(() => RequireUserGroup('   ')).toThrow(
+      'RequireUserGroup requires a non-empty group code',
+    );
+  });
+});

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/userGroup/require-user-group.decorator.ts

@@ -0,0 +1,15 @@
+import { SetMetadata } from '@nestjs/common';
+
+export const REQUIRED_USER_GROUP_KEY = 'required_user_group';
+
+/**
+ * Restricts an endpoint to authenticated users resolved from the given active
+ * user group. Nested active child groups are included by UserGroupService.
+ */
+export function RequireUserGroup(groupCode: string) {
+  const normalizedGroupCode = groupCode.trim();
+  if (!normalizedGroupCode) {
+    throw new Error('RequireUserGroup requires a non-empty group code');
+  }
+  return SetMetadata(REQUIRED_USER_GROUP_KEY, normalizedGroupCode);
+}

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/userGroup/user-group.guard.spec.ts

@@ -0,0 +1,90 @@
+import {
+  ExecutionContext,
+  ForbiddenException,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { UserGroupDomainError } from './user-group.errors';
+import { UserGroupGuard } from './user-group.guard';
+import { UserGroupService } from './user-group.service';
+
+function context(user?: { userid?: string | number; username?: string }) {
+  return {
+    getHandler: () => function handler() {},
+    getClass: () => class Controller {},
+    switchToHttp: () => ({ getRequest: () => ({ user }) }),
+  } as unknown as ExecutionContext;
+}
+
+describe('UserGroupGuard', () => {
+  const reflector = {
+    getAllAndOverride: jest.fn(),
+  };
+  const groups = {
+    isUserInGroup: jest.fn(),
+  };
+  const guard = new UserGroupGuard(
+    reflector as unknown as Reflector,
+    groups as unknown as UserGroupService,
+  );
+
+  beforeEach(() => jest.clearAllMocks());
+
+  it('allows endpoints without a required user group', async () => {
+    reflector.getAllAndOverride.mockReturnValue(undefined);
+
+    await expect(guard.canActivate(context())).resolves.toBe(true);
+    expect(groups.isUserInGroup).not.toHaveBeenCalled();
+  });
+
+  it('allows an authenticated member of the required group', async () => {
+    reflector.getAllAndOverride.mockReturnValue('it_ops');
+    groups.isUserInGroup.mockResolvedValue(true);
+
+    await expect(guard.canActivate(context({ userid: 'alice' }))).resolves.toBe(
+      true,
+    );
+    expect(groups.isUserInGroup).toHaveBeenCalledWith('it_ops', 'alice');
+  });
+
+  it('falls back to username when userid is unavailable', async () => {
+    reflector.getAllAndOverride.mockReturnValue('it_ops');
+    groups.isUserInGroup.mockResolvedValue(true);
+
+    await guard.canActivate(context({ username: 'alice' }));
+
+    expect(groups.isUserInGroup).toHaveBeenCalledWith('it_ops', 'alice');
+  });
+
+  it('rejects a request without an authenticated identity', async () => {
+    reflector.getAllAndOverride.mockReturnValue('it_ops');
+
+    await expect(guard.canActivate(context())).rejects.toBeInstanceOf(
+      UnauthorizedException,
+    );
+  });
+
+  it('rejects a user outside the required group', async () => {
+    reflector.getAllAndOverride.mockReturnValue('it_ops');
+    groups.isUserInGroup.mockResolvedValue(false);
+
+    await expect(
+      guard.canActivate(context({ userid: 'bob' })),
+    ).rejects.toBeInstanceOf(ForbiddenException);
+  });
+
+  it('fails closed when the configured group is missing', async () => {
+    reflector.getAllAndOverride.mockReturnValue('missing');
+    groups.isUserInGroup.mockRejectedValue(
+      new UserGroupDomainError(
+        'USER_GROUP_NOT_FOUND',
+        'User group not found',
+        404,
+      ),
+    );
+
+    await expect(
+      guard.canActivate(context({ userid: 'alice' })),
+    ).rejects.toBeInstanceOf(ForbiddenException);
+  });
+});

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/userGroup/user-group.guard.ts

@@ -0,0 +1,51 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Request } from 'express';
+import { UserGroupDomainError } from './user-group.errors';
+import { REQUIRED_USER_GROUP_KEY } from './require-user-group.decorator';
+import { UserGroupService } from './user-group.service';
+
+type AuthenticatedRequest = Request & {
+  user?: {
+    userid?: string | number;
+    username?: string;
+  };
+};
+
+@Injectable()
+export class UserGroupGuard implements CanActivate {
+  constructor(
+    private readonly reflector: Reflector,
+    private readonly groups: UserGroupService,
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const groupCode = this.reflector.getAllAndOverride<string>(
+      REQUIRED_USER_GROUP_KEY,
+      [context.getHandler(), context.getClass()],
+    );
+    if (!groupCode) return true;
+
+    const request = context.switchToHttp().getRequest<AuthenticatedRequest>();
+    const userId = request.user?.userid ?? request.user?.username;
+    if (userId === undefined || String(userId).trim() === '') {
+      throw new UnauthorizedException('Authenticated user is required');
+    }
+
+    try {
+      if (await this.groups.isUserInGroup(groupCode, String(userId))) {
+        return true;
+      }
+    } catch (error) {
+      if (!(error instanceof UserGroupDomainError)) throw error;
+    }
+
+    throw new ForbiddenException('User is not a member of the required group');
+  }
+}

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/userGroup/user-group.service.spec.ts

@@ -78,6 +78,24 @@ describe('UserGroupService', () => {
     });
   });
 
+  it('checks membership using resolved active users', async () => {
+    const { service } = createHarness();
+    jest
+      .spyOn(service, 'resolveUsers')
+      .mockResolvedValue([{ userid: 'alice', username: 'Alice' }]);
+
+    await expect(service.isUserInGroup('finance', 'alice')).resolves.toBe(true);
+    await expect(service.isUserInGroup('finance', 'bob')).resolves.toBe(false);
+  });
+
+  it('rejects blank membership identities without resolving the group', async () => {
+    const { service } = createHarness();
+    const resolveUsers = jest.spyOn(service, 'resolveUsers');
+
+    await expect(service.isUserInGroup('finance', '   ')).resolves.toBe(false);
+    expect(resolveUsers).not.toHaveBeenCalled();
+  });
+
   it('replaces members and bumps revision', async () => {
     const { service, tx } = createHarness();
     tx.user.findMany.mockResolvedValue([{ userid: 'u1' }]);

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/userGroup/user-group.service.ts

@@ -334,6 +334,13 @@ export class UserGroupService {
     return [...users.values()].sort((a, b) => a.userid.localeCompare(b.userid));
   }
 
+  async isUserInGroup(code: string, userId: string): Promise<boolean> {
+    const normalizedUserId = userId.trim();
+    if (!normalizedUserId) return false;
+    const users = await this.resolveUsers(code);
+    return users.some((user) => user.userid === normalizedUserId);
+  }
+
   private async findGroup(tx: Transaction, code: string) {
     const group = await tx.userGroup.findUnique({ where: { code } });
     if (!group) throw userGroupNotFound(code);

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/userGroup/userGroup.module.ts

@@ -1,10 +1,11 @@
 import { Module } from '@nestjs/common';
 import { UserGroupController } from './user-group.controller';
+import { UserGroupGuard } from './user-group.guard';
 import { UserGroupService } from './user-group.service';
 
 @Module({
   controllers: [UserGroupController],
-  providers: [UserGroupService],
-  exports: [UserGroupService],
+  providers: [UserGroupService, UserGroupGuard],
+  exports: [UserGroupService, UserGroupGuard],
 })
 export class UserGroupModule {}

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/workflow/workflow.controller.ts

@@ -24,6 +24,7 @@ import { Request } from 'express';
 import { UseRoles } from 'nest-access-control';
 import { PrismaService } from 'nestjs-prisma';
 import { AllowUnauthorizedRequest } from '../../lib/auth.guard';
+import { AllowTransferExportRequest } from '../permTransfer/transfer-export.decorator';
 import { TemporalService } from './temporal.service';
 import { listWorkflowDatabaseFunctions } from './workflow-database-function';
 import {
@@ -196,7 +197,7 @@ export class WorkflowController {
   }
 
   @Get('export/:code')
-  @AllowUnauthorizedRequest()
+  @AllowTransferExportRequest()
   async getExportPayload(
     @Param('code') code: string,
     @Query('token') token: string,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gadmin2n/schematics",
-  "version": "0.0.157",
+  "version": "0.0.158",
   "description": "Gadmin - modern, fast, powerful node.js web framework (@schematics)",
   "main": "dist/index.js",
   "files": [