@goplusvn/core 0.1.0

package/dist/audit/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/infrastructure/logger/logger.ts","../../src/audit/memory-audit-logger.ts","../../src/audit/audit-manager.ts"],"names":["logger"],"mappings":";AAEA,IAAM,UAAA,GAAuC;AAAA,EAC3C,KAAA,EAAO,CAAA;AAAA,EACP,KAAA,EAAO,CAAA;AAAA,EACP,IAAA,EAAM,CAAA;AAAA,EACN,IAAA,EAAM,CAAA;AAAA,EACN,KAAA,EAAO;AACT,CAAA;AAEA,SAAS,WAAA,GAAwB;AAC/B,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,SAAA,EAAW,WAAA,EAAY;AACpD,EAAA,IAAI,QAAA,IAAY,UAAA,CAAW,QAAQ,CAAA,KAAM,MAAA,EAAW;AAClD,IAAA,OAAO,QAAA;AAAA,EACT;AACA,EAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,YAAA,GAAe,MAAA,GAAS,OAAA;AAC1D;AAEA,SAAS,aAAA,CACP,KAAA,EACA,IAAA,EACA,OAAA,EACA,OAAA,EACQ;AACR,EAAA,MAAM,SAAA,GAAA,iBAAY,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AACzC,EAAA,MAAM,aAAa,OAAA,GAAU,CAAA,CAAA,EAAI,KAAK,SAAA,CAAU,OAAO,CAAC,CAAA,CAAA,GAAK,EAAA;AAC7D,EAAA,OAAO,CAAA,EAAG,SAAS,CAAA,EAAA,EAAK,KAAA,CAAM,WAAA,EAAa,CAAA,GAAA,EAAM,IAAI,CAAA,EAAA,EAAK,OAAO,CAAA,EAAG,UAAU,CAAA,CAAA;AAChF;AAEA,SAAS,SAAA,CAAU,OAAiB,QAAA,EAA6B;AAC/D,EAAA,OAAO,UAAA,CAAW,KAAK,CAAA,IAAK,UAAA,CAAW,QAAQ,CAAA;AACjD;AAEA,IAAM,gBAAN,MAAsC;AAAA,EAIpC,WAAA,CAAY,OAAA,GAAyB,EAAC,EAAG;AACvC,IAAA,IAAA,CAAK,IAAA,GAAO,QAAQ,IAAA,IAAQ,KAAA;AAC5B,IAAA,IAAA,CAAK,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,WAAA,EAAY;AAAA,EAC5C;AAAA,EAEA,KAAA,CAAM,SAAiB,OAAA,EAA4B;AACjD,IAAA,IAAI,SAAA,CAAU,OAAA,EAAS,IAAA,CAAK,KAAK,CAAA,EAAG;AAClC,MAAA,OAAA,CAAQ,IAAI,aAAA,CAAc,OAAA,EAAS,KAAK,IAAA,EAAM,OAAA,EAAS,OAAO,CAAC,CAAA;AAAA,IACjE;AAAA,EACF;AAAA,EAEA,KAAA,CAAM,SAAiB,OAAA,EAA4B;AACjD,IAAA,IAAI,SAAA,CAAU,OAAA,EAAS,IAAA,CAAK,KAAK,CAAA,EAAG;AAClC,MAAA,OAAA,CAAQ,IAAI,aAAA,CAAc,OAAA,EAAS,KAAK,IAAA,EAAM,OAAA,EAAS,OAAO,CAAC,CAAA;AAAA,IACjE;AAAA,EACF;AAAA,EAEA,IAAA,CAAK,SAAiB,OAAA,EAA4B;AAChD,IAAA,IAAI,SAAA,CAAU,MAAA,EAAQ,IAAA,CAAK,KAAK,CAAA,EAAG;AACjC,MAAA,OAAA,CAAQ,KAAK,aAAA,CAAc,MAAA,EAAQ,KAAK,IAAA,EAAM,OAAA,EAAS,OAAO,CAAC,CAAA;AAAA,IACjE;AAAA,EACF;AAAA,EAEA,IAAA,CAAK,SAAiB,OAAA,EAA4B;AAChD,IAAA,IAAI,SAAA,CAAU,MAAA,EAAQ,IAAA,CAAK,KAAK,CAAA,EAAG;AACjC,MAAA,OAAA,CAAQ,KAAK,aAAA,CAAc,MAAA,EAAQ,KAAK,IAAA,EAAM,OAAA,EAAS,OAAO,CAAC,CAAA;AAAA,IACjE;AAAA,EACF;AAAA,EAEA,KAAA,CAAM,SAAiB,OAAA,EAA4B;AACjD,IAAA,IAAI,SAAA,CAAU,OAAA,EAAS,IAAA,CAAK,KAAK,CAAA,EAAG;AAClC,MAAA,OAAA,CAAQ,MAAM,aAAA,CAAc,OAAA,EAAS,KAAK,IAAA,EAAM,OAAA,EAAS,OAAO,CAAC,CAAA;AAAA,IACnE;AAAA,EACF;AACF,CAAA;AAcO,SAAS,YAAA,CACd,aAAA,GAAwC,EAAC,EACjC;AACR,EAAA,MAAM,UACJ,OAAO,aAAA,KAAkB,WAAW,EAAE,IAAA,EAAM,eAAc,GAAI,aAAA;AAEhE,EAAA,OAAO,IAAI,cAAc,OAAO,CAAA;AAClC;AAGsB,aAAa,KAAK;;;AC5EjC,IAAM,oBAAN,MAA+C;AAAA,EAIpD,WAAA,CAAY,UAAU,GAAA,EAAM;AAH5B,IAAA,IAAA,CAAQ,OAAmB,EAAC;AAI1B,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AAAA,EAEA,MAAM,IAAI,KAAA,EAAgC;AAExC,IAAA,IAAA,CAAK,IAAA,CAAK,QAAQ,KAAK,CAAA;AAGvB,IAAA,IAAI,IAAA,CAAK,IAAA,CAAK,MAAA,GAAS,IAAA,CAAK,OAAA,EAAS;AACnC,MAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,KAAK,OAAO,CAAA;AAAA,IAC7C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,OAAA,CAAQ,MAAA,GAAyB,EAAC,EAAe;AAC/C,IAAA,IAAI,WAAW,IAAA,CAAK,IAAA;AAEpB,IAAA,IAAI,OAAO,QAAA,EAAU;AACnB,MAAA,QAAA,GAAW,SAAS,MAAA,CAAO,CAAC,QAAQ,GAAA,CAAI,SAAA,IAAa,OAAO,QAAS,CAAA;AAAA,IACvE;AAEA,IAAA,IAAI,OAAO,MAAA,EAAQ;AACjB,MAAA,QAAA,GAAW,SAAS,MAAA,CAAO,CAAC,QAAQ,GAAA,CAAI,SAAA,IAAa,OAAO,MAAO,CAAA;AAAA,IACrE;AAEA,IAAA,IAAI,OAAO,MAAA,EAAQ;AACjB,MAAA,QAAA,GAAW,SAAS,MAAA,CAAO,CAAC,QAAQ,GAAA,CAAI,MAAA,KAAW,OAAO,MAAM,CAAA;AAAA,IAClE;AAEA,IAAA,IAAI,OAAO,MAAA,EAAQ;AACjB,MAAA,QAAA,GAAW,SAAS,MAAA,CAAO,CAAC,QAAQ,GAAA,CAAI,MAAA,KAAW,OAAO,MAAM,CAAA;AAAA,IAClE;AAEA,IAAA,IAAI,OAAO,QAAA,EAAU;AACnB,MAAA,QAAA,GAAW,SAAS,MAAA,CAAO,CAAC,QAAQ,GAAA,CAAI,QAAA,KAAa,OAAO,QAAQ,CAAA;AAAA,IACtE;AAGA,IAAA,IAAI,OAAO,IAAA,EAAM;AACf,MAAA,QAAA,GAAW,QAAA,CAAS,MAAA,CAAO,CAAC,GAAA,KAAQ;AAClC,QAAA,IAAI,OAAO,IAAA,KAAS,OAAA,EAAS,OAAA,CAAQ,GAAA,CAAI,UAAU,GAAA,KAAQ,GAAA;AAC3D,QAAA,IAAI,OAAO,IAAA,KAAS,SAAA;AAClB,UAAA,OAAA,CAAQ,IAAI,MAAA,IAAU,GAAA,KAAQ,GAAA,IAAA,CAAQ,GAAA,CAAI,UAAU,GAAA,IAAO,GAAA;AAC7D,QAAA,OAAA,CAAQ,GAAA,CAAI,UAAU,GAAA,IAAO,GAAA;AAAA,MAC/B,CAAC,CAAA;AAAA,IACH;AAEA,IAAA,MAAM,MAAA,GAAS,OAAO,MAAA,IAAU,CAAA;AAChC,IAAA,MAAM,KAAA,GAAQ,OAAO,KAAA,IAAS,EAAA;AAE9B,IAAA,OAAO,QAAA,CAAS,KAAA,CAAM,MAAA,EAAQ,MAAA,GAAS,KAAK,CAAA;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA,EAKA,KAAA,GAAc;AACZ,IAAA,IAAA,CAAK,OAAO,EAAC;AAAA,EACf;AACF,CAAA;;;AC5EA,IAAMA,OAAAA,GAAS,aAAa,cAAc,CAAA;AAM1C,IAAM,qBAAN,MAAgD;AAAA,EAC9C,MAAM,IAAI,KAAA,EAAgC;AACxC,IAAAA,OAAAA,CAAO,KAAK,CAAA,OAAA,EAAU,KAAA,CAAM,MAAM,CAAA,CAAA,EAAI,KAAA,CAAM,QAAQ,CAAA,CAAA,EAAI;AAAA,MACtD,IAAI,KAAA,CAAM,EAAA;AAAA,MACV,YAAY,KAAA,CAAM,UAAA;AAAA,MAClB,QAAQ,KAAA,CAAM,MAAA;AAAA,MACd,SAAS,KAAA,CAAM;AAAA,KAChB,CAAA;AAAA,EACH;AACF;AAmBA,IAAM,mBAAN,MAAuB;AAAA,EAIrB,WAAA,CAAY,OAAA,GAA+B,EAAC,EAAG;AAC7C,IAAA,IAAA,CAAK,WAAA,GAAc,OAAA,CAAQ,MAAA,IAAU,IAAI,iBAAA,EAAkB;AAC3D,IAAA,IAAA,CAAK,oBAAoB,IAAI,GAAA;AAAA,MAC3B,QAAQ,OAAA,IAAW,CAAC,UAAU,QAAA,EAAU,QAAA,EAAU,SAAS,QAAQ;AAAA,KACrE;AAAA,EACF;AAAA;AAAA,EAGA,UAAU,WAAA,EAAgC;AACxC,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AAAA,EACrB;AAAA;AAAA,EAGA,eAAe,MAAA,EAAsB;AACnC,IAAA,IAAA,CAAK,iBAAA,CAAkB,IAAI,MAAM,CAAA;AAAA,EACnC;AAAA;AAAA,EAGA,aAAa,MAAA,EAAyB;AACpC,IAAA,OAAO,IAAA,CAAK,iBAAA,CAAkB,GAAA,CAAI,MAAM,CAAA;AAAA,EAC1C;AAAA;AAAA,EAGA,MAAM,IAAI,KAAA,EAAwC;AAChD,IAAA,MAAM,KAAA,GAAkB;AAAA,MACtB,EAAA,EAAI,OAAO,UAAA,EAAW;AAAA,MACtB,GAAG,KAAA;AAAA,MACH,SAAA,sBAAe,IAAA;AAAK,KACtB;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,KAAK,CAAA;AAAA,IAClC,SAAS,KAAA,EAAO;AACd,MAAAA,OAAAA,CAAO,MAAM,2BAAA,EAA6B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AAAA,IACpE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,OAAA,CAAQ,MAAA,GAAc,EAAC,EAAe;AACpC,IAAA,IAAI,SAAA,IAAa,KAAK,WAAA,EAAa;AACjC,MAAA,OAAQ,IAAA,CAAK,WAAA,CAAoB,OAAA,CAAQ,MAAM,CAAA;AAAA,IACjD;AACA,IAAA,OAAO,EAAC;AAAA,EACV;AAAA;AAAA,EAGA,UAAA,GAAa;AACX,IAAA,OAAO,OACL,KAMA,IAAA,KACkB;AAClB,MAAA,MAAM,SAAA,GAAY,KAAK,GAAA,EAAI;AAC3B,MAAA,IAAI,KAAA,GAAsB,IAAA;AAE1B,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,EAAK;AAAA,MACb,SAAS,CAAA,EAAG;AACV,QAAA,KAAA,GAAQ,CAAA;AACR,QAAA,MAAM,CAAA;AAAA,MACR,CAAA,SAAE;AACA,QAAA,IAAI,IAAI,MAAA,IAAU,IAAA,CAAK,aAAa,GAAA,CAAI,MAAA,CAAO,UAAU,CAAA,EAAG;AAC1D,UAAA,MAAM,KAAK,GAAA,CAAI;AAAA,YACb,MAAA,EAAQ,IAAI,MAAA,CAAO,UAAA;AAAA,YACnB,QAAA,EAAU,IAAI,MAAA,CAAO,YAAA;AAAA,YACrB,MAAA,EAAQ,GAAA,CAAI,KAAA,EAAO,WAAA,EAAa,EAAA;AAAA,YAChC,QAAA,EAAU,IAAI,KAAA,EAAO,WAAA;AAAA,YACrB,EAAA,EAAI,IAAI,OAAA,EAAS,EAAA;AAAA,YACjB,SAAA,EAAW,GAAA,CAAI,OAAA,EAAS,MAAA,GAAS,YAAY,CAAA;AAAA,YAC7C,MAAA,EAAQ,GAAA,CAAI,MAAA,KAAW,KAAA,GAAQ,GAAA,GAAM,GAAA,CAAA;AAAA,YACrC,QAAA,EAAU;AAAA,cACR,QAAA,EAAU,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAAA,cACvB,GAAI,KAAA,IAAS,EAAE,KAAA,EAAO,MAAM,OAAA;AAAQ;AACtC,WACD,CAAA;AAAA,QACH;AAAA,MACF;AAAA,IACF,CAAA;AAAA,EACF;AACF;AAGO,IAAM,YAAA,GAAe,IAAI,gBAAA","file":"index.mjs","sourcesContent":["import type { Logger, LoggerOptions, LogContext, LogLevel } from \"./types\";\n\nconst LOG_LEVELS: Record<LogLevel, number> = {\n  trace: 0,\n  debug: 1,\n  info: 2,\n  warn: 3,\n  error: 4,\n};\n\nfunction getLogLevel(): LogLevel {\n  const envLevel = process.env.LOG_LEVEL?.toLowerCase() as LogLevel;\n  if (envLevel && LOG_LEVELS[envLevel] !== undefined) {\n    return envLevel;\n  }\n  return process.env.NODE_ENV === \"production\" ? \"info\" : \"debug\";\n}\n\nfunction formatMessage(\n  level: LogLevel,\n  name: string,\n  message: string,\n  context?: LogContext,\n): string {\n  const timestamp = new Date().toISOString();\n  const contextStr = context ? ` ${JSON.stringify(context)}` : \"\";\n  return `${timestamp} [${level.toUpperCase()}] [${name}] ${message}${contextStr}`;\n}\n\nfunction shouldLog(level: LogLevel, minLevel: LogLevel): boolean {\n  return LOG_LEVELS[level] >= LOG_LEVELS[minLevel];\n}\n\nclass ConsoleLogger implements Logger {\n  private name: string;\n  private level: LogLevel;\n\n  constructor(options: LoggerOptions = {}) {\n    this.name = options.name || \"App\";\n    this.level = options.level || getLogLevel();\n  }\n\n  trace(message: string, context?: LogContext): void {\n    if (shouldLog(\"trace\", this.level)) {\n      console.log(formatMessage(\"trace\", this.name, message, context));\n    }\n  }\n\n  debug(message: string, context?: LogContext): void {\n    if (shouldLog(\"debug\", this.level)) {\n      console.log(formatMessage(\"debug\", this.name, message, context));\n    }\n  }\n\n  info(message: string, context?: LogContext): void {\n    if (shouldLog(\"info\", this.level)) {\n      console.info(formatMessage(\"info\", this.name, message, context));\n    }\n  }\n\n  warn(message: string, context?: LogContext): void {\n    if (shouldLog(\"warn\", this.level)) {\n      console.warn(formatMessage(\"warn\", this.name, message, context));\n    }\n  }\n\n  error(message: string, context?: LogContext): void {\n    if (shouldLog(\"error\", this.level)) {\n      console.error(formatMessage(\"error\", this.name, message, context));\n    }\n  }\n}\n\n/**\n * Create a logger instance with the given name/options\n *\n * @example\n * ```typescript\n * import { createLogger } from '@goerp/core/infrastructure';\n *\n * const logger = createLogger('OrderService');\n * logger.info('Order created', { orderId: '123' });\n * logger.error('Payment failed', { error: err.message });\n * ```\n */\nexport function createLogger(\n  nameOrOptions: string | LoggerOptions = {},\n): Logger {\n  const options =\n    typeof nameOrOptions === \"string\" ? { name: nameOrOptions } : nameOrOptions;\n\n  return new ConsoleLogger(options);\n}\n\n// Default app logger\nexport const logger = createLogger(\"App\");\n","import type { AuditLog, AuditLogger } from \"./types\";\n\n/**\n * Filter options for retrieving audit logs\n */\nexport interface AuditLogFilter {\n  fromDate?: Date;\n  toDate?: Date;\n  userId?: string;\n  action?: string;\n  resource?: string;\n  type?: \"info\" | \"warning\" | \"error\";\n  limit?: number;\n  offset?: number;\n}\n\n/**\n * In-memory audit logger that supports retrieval\n */\nexport class MemoryAuditLogger implements AuditLogger {\n  private logs: AuditLog[] = [];\n  private readonly maxLogs: number;\n\n  constructor(maxLogs = 1000) {\n    this.maxLogs = maxLogs;\n  }\n\n  async log(entry: AuditLog): Promise<void> {\n    // Add to beginning of array\n    this.logs.unshift(entry);\n\n    // Trim if exceeds max size\n    if (this.logs.length > this.maxLogs) {\n      this.logs = this.logs.slice(0, this.maxLogs);\n    }\n  }\n\n  /**\n   * Get logs with filtering\n   */\n  getLogs(filter: AuditLogFilter = {}): AuditLog[] {\n    let filtered = this.logs;\n\n    if (filter.fromDate) {\n      filtered = filtered.filter((log) => log.createdAt >= filter.fromDate!);\n    }\n\n    if (filter.toDate) {\n      filtered = filtered.filter((log) => log.createdAt <= filter.toDate!);\n    }\n\n    if (filter.userId) {\n      filtered = filtered.filter((log) => log.userId === filter.userId);\n    }\n\n    if (filter.action) {\n      filtered = filtered.filter((log) => log.action === filter.action);\n    }\n\n    if (filter.resource) {\n      filtered = filtered.filter((log) => log.resource === filter.resource);\n    }\n\n    // \"type\" filter is a fuzzy mapping based on status code or action name for demo purposes\n    if (filter.type) {\n      filtered = filtered.filter((log) => {\n        if (filter.type === \"error\") return (log.status || 200) >= 400;\n        if (filter.type === \"warning\")\n          return (log.status || 200) >= 300 && (log.status || 200) < 400;\n        return (log.status || 200) < 300;\n      });\n    }\n\n    const offset = filter.offset || 0;\n    const limit = filter.limit || 50;\n\n    return filtered.slice(offset, offset + limit);\n  }\n\n  /**\n   * Clear all logs\n   */\n  clear(): void {\n    this.logs = [];\n  }\n}\n","import type {\n  AuditLog,\n  AuditLogger,\n  AuditManagerOptions,\n  CreateAuditInput,\n} from \"./types\";\nimport { createLogger } from \"../infrastructure/logger\";\nimport { MemoryAuditLogger } from \"./memory-audit-logger\";\n\nconst logger = createLogger(\"AuditManager\");\n\n/**\n * Console-based audit logger (default)\n * In production, replace with database or external service\n */\nclass ConsoleAuditLogger implements AuditLogger {\n  async log(entry: AuditLog): Promise<void> {\n    logger.info(`AUDIT: ${entry.action} ${entry.resource}`, {\n      id: entry.id,\n      resourceId: entry.resourceId,\n      userId: entry.userId,\n      changes: entry.changes,\n    });\n  }\n}\n\n/**\n * AuditManager - tracks actions for compliance and debugging\n *\n * @example\n * ```typescript\n * import { auditManager } from '@goerp/core/audit';\n *\n * // Log an action\n * await auditManager.log({\n *   action: 'update',\n *   resource: 'purchase-order',\n *   resourceId: '123',\n *   userId: session.user.id,\n *   changes: { status: { old: 'pending', new: 'approved' } }\n * });\n * ```\n */\nclass AuditManagerImpl {\n  private auditLogger: AuditLogger;\n  private registeredActions: Set<string>;\n\n  constructor(options: AuditManagerOptions = {}) {\n    this.auditLogger = options.logger || new MemoryAuditLogger();\n    this.registeredActions = new Set(\n      options.actions || [\"create\", \"update\", \"delete\", \"login\", \"logout\"],\n    );\n  }\n\n  /** Set custom audit logger */\n  setLogger(auditLogger: AuditLogger): void {\n    this.auditLogger = auditLogger;\n  }\n\n  /** Register action for automatic auditing */\n  registerAction(action: string): void {\n    this.registeredActions.add(action);\n  }\n\n  /** Check if action is registered for auditing */\n  isRegistered(action: string): boolean {\n    return this.registeredActions.has(action);\n  }\n\n  /** Log an audit entry */\n  async log(input: CreateAuditInput): Promise<void> {\n    const entry: AuditLog = {\n      id: crypto.randomUUID(),\n      ...input,\n      createdAt: new Date(),\n    };\n\n    try {\n      await this.auditLogger.log(entry);\n    } catch (error) {\n      logger.error(\"Failed to log audit entry\", { error: String(error) });\n    }\n  }\n\n  /**\n   * Get logs if the logger supports it (specifically MemoryAuditLogger)\n   */\n  getLogs(filter: any = {}): AuditLog[] {\n    if (\"getLogs\" in this.auditLogger) {\n      return (this.auditLogger as any).getLogs(filter);\n    }\n    return [];\n  }\n\n  /** Create middleware for automatic API route auditing */\n  middleware() {\n    return async (\n      ctx: {\n        action?: { actionName: string; resourceName: string };\n        state?: { currentUser?: { id: string }; currentRole?: string };\n        request?: { ip?: string; header?: Record<string, string> };\n        status?: number;\n      },\n      next: () => Promise<void>,\n    ): Promise<void> => {\n      const startTime = Date.now();\n      let error: Error | null = null;\n\n      try {\n        await next();\n      } catch (e) {\n        error = e as Error;\n        throw e;\n      } finally {\n        if (ctx.action && this.isRegistered(ctx.action.actionName)) {\n          await this.log({\n            action: ctx.action.actionName,\n            resource: ctx.action.resourceName,\n            userId: ctx.state?.currentUser?.id,\n            roleName: ctx.state?.currentRole,\n            ip: ctx.request?.ip,\n            userAgent: ctx.request?.header?.[\"user-agent\"],\n            status: ctx.status || (error ? 500 : 200),\n            metadata: {\n              duration: Date.now() - startTime,\n              ...(error && { error: error.message }),\n            },\n          });\n        }\n      }\n    };\n  }\n}\n\n// Singleton instance\nexport const auditManager = new AuditManagerImpl();\n\n// Export class for testing\nexport { AuditManagerImpl, ConsoleAuditLogger, MemoryAuditLogger };\n"]}

package/dist/auth/index.d.mts

@@ -0,0 +1,86 @@
+import { Session } from 'next-auth';
+
+interface AuthPrismaClient {
+    user: any;
+}
+declare function verifyPassword(password: string, hash: string): Promise<boolean>;
+interface AuthenticatedUser {
+    id: string;
+    email: string | null;
+    name: string;
+    avatar: string | null;
+    status: string;
+}
+interface AuthError {
+    message: string;
+    email?: string;
+}
+/**
+ * Authenticate user with email and password
+ * Returns user data if successful, throws error if failed
+ */
+declare function authenticateUser(db: AuthPrismaClient, email: string, password: string): Promise<AuthenticatedUser>;
+
+interface Permission {
+    resourceCode: string;
+    actionCode: string;
+}
+interface ExtendedUser {
+    id: string;
+    name?: string | null;
+    email?: string | null;
+    image?: string | null;
+    roles?: string[];
+    permissions?: Permission[];
+}
+interface UserSession {
+    user: ExtendedUser;
+}
+interface CrudPermissionResult {
+    create: boolean;
+    view: boolean;
+    update: boolean;
+    delete: boolean;
+    export: boolean;
+    import: boolean;
+    approve: boolean;
+    reject: boolean;
+}
+/**
+ * Get action code from action name
+ */
+declare function getActionCode(action: string): string;
+/**
+ * Get all permissions from session
+ */
+declare function getUserPermissions(session: Session | null): Permission[];
+/**
+ * Get CRUD permissions from session for a specific entity
+ */
+declare function getCrudPermissionsFromSession(session: Session | null, entity: string): CrudPermissionResult;
+/**
+ * Check if user has a specific permission
+ */
+declare function checkPermission(session: Session | null, resourceCode: string, actionCode: string): boolean;
+/**
+ * Alias for checkPermission
+ */
+declare function hasPermission(session: Session | null, resourceCode: string, actionCode: string): boolean;
+/**
+ * Require permission - throw error if not authorized
+ */
+declare function requirePermission(session: Session | null, resourceCode: string, actionCode: string): void;
+/**
+ * Check if user has a specific role
+ */
+declare function hasRole(session: Session | null, roleCode: string): boolean;
+/**
+ * Check if user has any of the specified roles
+ */
+declare function hasAnyRole(session: Session | null, roleCodes: string[]): boolean;
+/**
+ * Check if user is admin
+ */
+declare function isAdmin(session: Session | null): boolean;
+
+export { type AuthError, type AuthPrismaClient, type AuthenticatedUser, type CrudPermissionResult, type ExtendedUser, type Permission, type UserSession, authenticateUser, checkPermission, getActionCode, getCrudPermissionsFromSession, getUserPermissions, hasAnyRole, hasPermission, hasRole, isAdmin, requirePermission, verifyPassword };

package/dist/auth/index.d.ts

@@ -0,0 +1,86 @@
+import { Session } from 'next-auth';
+
+interface AuthPrismaClient {
+    user: any;
+}
+declare function verifyPassword(password: string, hash: string): Promise<boolean>;
+interface AuthenticatedUser {
+    id: string;
+    email: string | null;
+    name: string;
+    avatar: string | null;
+    status: string;
+}
+interface AuthError {
+    message: string;
+    email?: string;
+}
+/**
+ * Authenticate user with email and password
+ * Returns user data if successful, throws error if failed
+ */
+declare function authenticateUser(db: AuthPrismaClient, email: string, password: string): Promise<AuthenticatedUser>;
+
+interface Permission {
+    resourceCode: string;
+    actionCode: string;
+}
+interface ExtendedUser {
+    id: string;
+    name?: string | null;
+    email?: string | null;
+    image?: string | null;
+    roles?: string[];
+    permissions?: Permission[];
+}
+interface UserSession {
+    user: ExtendedUser;
+}
+interface CrudPermissionResult {
+    create: boolean;
+    view: boolean;
+    update: boolean;
+    delete: boolean;
+    export: boolean;
+    import: boolean;
+    approve: boolean;
+    reject: boolean;
+}
+/**
+ * Get action code from action name
+ */
+declare function getActionCode(action: string): string;
+/**
+ * Get all permissions from session
+ */
+declare function getUserPermissions(session: Session | null): Permission[];
+/**
+ * Get CRUD permissions from session for a specific entity
+ */
+declare function getCrudPermissionsFromSession(session: Session | null, entity: string): CrudPermissionResult;
+/**
+ * Check if user has a specific permission
+ */
+declare function checkPermission(session: Session | null, resourceCode: string, actionCode: string): boolean;
+/**
+ * Alias for checkPermission
+ */
+declare function hasPermission(session: Session | null, resourceCode: string, actionCode: string): boolean;
+/**
+ * Require permission - throw error if not authorized
+ */
+declare function requirePermission(session: Session | null, resourceCode: string, actionCode: string): void;
+/**
+ * Check if user has a specific role
+ */
+declare function hasRole(session: Session | null, roleCode: string): boolean;
+/**
+ * Check if user has any of the specified roles
+ */
+declare function hasAnyRole(session: Session | null, roleCodes: string[]): boolean;
+/**
+ * Check if user is admin
+ */
+declare function isAdmin(session: Session | null): boolean;
+
+export { type AuthError, type AuthPrismaClient, type AuthenticatedUser, type CrudPermissionResult, type ExtendedUser, type Permission, type UserSession, authenticateUser, checkPermission, getActionCode, getCrudPermissionsFromSession, getUserPermissions, hasAnyRole, hasPermission, hasRole, isAdmin, requirePermission, verifyPassword };

package/dist/auth/index.js

@@ -0,0 +1,210 @@
+'use strict';
+
+// src/auth/auth-service.ts
+async function verifyPassword(password, hash) {
+  try {
+    const bcrypt = await import('bcryptjs');
+    return bcrypt.compareSync(password, hash);
+  } catch (error) {
+    console.error("Error verifying password", error);
+    return false;
+  }
+}
+async function authenticateUser(db, email, password) {
+  try {
+    const user = await db.user.findUnique({
+      where: { email: email.toLowerCase().trim() },
+      select: {
+        id: true,
+        email: true,
+        name: true,
+        avatar: true,
+        password: true,
+        isActive: true
+      }
+    });
+    if (!user) {
+      throw new Error("Invalid email or password");
+    }
+    if (!user.isActive) {
+      throw new Error("ACCOUNT_SUSPENDED");
+    }
+    if (!user.password) {
+      throw new Error("Invalid email or password");
+    }
+    const isPasswordValid = await verifyPassword(password, user.password);
+    if (!isPasswordValid) {
+      throw new Error("Invalid email or password");
+    }
+    await db.user.update({
+      where: { id: user.id },
+      data: { lastLoginAt: /* @__PURE__ */ new Date() }
+    });
+    return {
+      id: user.id,
+      name: user.name || "",
+      email: user.email,
+      avatar: user.avatar || null,
+      status: "ONLINE"
+    };
+  } catch (error) {
+    if (error instanceof Error) {
+      throw error;
+    }
+    throw new Error("Error signing in");
+  }
+}
+
+// src/auth/index.ts
+var ADMIN_ROLE_CODE = "admin";
+var BYPASS_AUTH = process.env.BYPASS_AUTH === "true" || process.env.BYPASS_AUTH === "1";
+var ACTION_CODES = {
+  create: "create",
+  view: "view",
+  update: "update",
+  delete: "delete",
+  export: "export",
+  import: "import",
+  approve: "approve",
+  reject: "reject"
+};
+function getActionCode(action) {
+  return ACTION_CODES[action] || action;
+}
+function getUserPermissions(session) {
+  if (!session?.user) return [];
+  const user = session.user;
+  if (!user.permissions) {
+    return [];
+  }
+  return user.permissions;
+}
+function getCrudPermissionsFromSession(session, entity) {
+  if (BYPASS_AUTH) {
+    return {
+      create: true,
+      view: true,
+      update: true,
+      delete: true,
+      export: true,
+      import: true,
+      approve: true,
+      reject: true
+    };
+  }
+  if (!session?.user) {
+    return {
+      create: false,
+      view: false,
+      update: false,
+      delete: false,
+      export: false,
+      import: false,
+      approve: false,
+      reject: false
+    };
+  }
+  const user = session.user;
+  if (!user.id) {
+    return {
+      create: false,
+      view: false,
+      update: false,
+      delete: false,
+      export: false,
+      import: false,
+      approve: false,
+      reject: false
+    };
+  }
+  const isAdmin2 = user.roles?.includes(ADMIN_ROLE_CODE) || user.roles?.includes("SUPER_ADMIN");
+  if (isAdmin2) {
+    return {
+      create: true,
+      view: true,
+      update: true,
+      delete: true,
+      export: true,
+      import: true,
+      approve: true,
+      reject: true
+    };
+  }
+  const permissions = user.permissions || [];
+  const permissionKeys = new Set(
+    permissions.map((p) => `${p.resourceCode}:${p.actionCode}`)
+  );
+  const hasPermission2 = (action) => {
+    const key = `${entity}:${action}`;
+    return permissionKeys.has(key);
+  };
+  return {
+    create: hasPermission2(getActionCode("create")),
+    view: hasPermission2(getActionCode("view")),
+    update: hasPermission2(getActionCode("update")),
+    delete: hasPermission2(getActionCode("delete")),
+    export: hasPermission2(getActionCode("export")),
+    import: hasPermission2(getActionCode("import")),
+    approve: hasPermission2(getActionCode("approve")),
+    reject: hasPermission2(getActionCode("reject"))
+  };
+}
+function checkPermission(session, resourceCode, actionCode) {
+  if (BYPASS_AUTH) {
+    return true;
+  }
+  if (!session?.user) return false;
+  const user = session.user;
+  if (!user.permissions || user.permissions.length === 0) {
+    return false;
+  }
+  if (user.roles?.includes(ADMIN_ROLE_CODE) || user.roles?.includes("SUPER_ADMIN")) {
+    return true;
+  }
+  return user.permissions.some(
+    (p) => p.resourceCode === resourceCode && p.actionCode === actionCode
+  );
+}
+function hasPermission(session, resourceCode, actionCode) {
+  return checkPermission(session, resourceCode, actionCode);
+}
+function requirePermission(session, resourceCode, actionCode) {
+  if (!checkPermission(session, resourceCode, actionCode)) {
+    throw new Error(
+      `Unauthorized: User does not have permission ${actionCode} on ${resourceCode}`
+    );
+  }
+}
+function hasRole(session, roleCode) {
+  if (!session?.user) return false;
+  const user = session.user;
+  if (!user.roles) {
+    return false;
+  }
+  return user.roles.includes(roleCode);
+}
+function hasAnyRole(session, roleCodes) {
+  if (!session?.user) return false;
+  const user = session.user;
+  if (!user.roles) {
+    return false;
+  }
+  return roleCodes.some((role) => user.roles.includes(role));
+}
+function isAdmin(session) {
+  return hasRole(session, ADMIN_ROLE_CODE);
+}
+
+exports.authenticateUser = authenticateUser;
+exports.checkPermission = checkPermission;
+exports.getActionCode = getActionCode;
+exports.getCrudPermissionsFromSession = getCrudPermissionsFromSession;
+exports.getUserPermissions = getUserPermissions;
+exports.hasAnyRole = hasAnyRole;
+exports.hasPermission = hasPermission;
+exports.hasRole = hasRole;
+exports.isAdmin = isAdmin;
+exports.requirePermission = requirePermission;
+exports.verifyPassword = verifyPassword;
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/auth-service.ts","../../src/auth/index.ts"],"names":["isAdmin","hasPermission"],"mappings":";;;AAMA,eAAsB,cAAA,CACpB,UACA,IAAA,EACkB;AAClB,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAM,OAAO,UAAU,CAAA;AACtC,IAAA,OAAO,MAAA,CAAO,WAAA,CAAY,QAAA,EAAU,IAAI,CAAA;AAAA,EAC1C,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,4BAA4B,KAAK,CAAA;AAC/C,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAmBA,eAAsB,gBAAA,CACpB,EAAA,EACA,KAAA,EACA,QAAA,EAC4B;AAC5B,EAAA,IAAI;AAEF,IAAA,MAAM,IAAA,GAAO,MAAM,EAAA,CAAG,IAAA,CAAK,UAAA,CAAW;AAAA,MACpC,OAAO,EAAE,KAAA,EAAO,MAAM,WAAA,EAAY,CAAE,MAAK,EAAE;AAAA,MAC3C,MAAA,EAAQ;AAAA,QACN,EAAA,EAAI,IAAA;AAAA,QACJ,KAAA,EAAO,IAAA;AAAA,QACP,IAAA,EAAM,IAAA;AAAA,QACN,MAAA,EAAQ,IAAA;AAAA,QACR,QAAA,EAAU,IAAA;AAAA,QACV,QAAA,EAAU;AAAA;AACZ,KACD,CAAA;AAGD,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAAA,IAC7C;AAGA,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AAClB,MAAA,MAAM,IAAI,MAAM,mBAAmB,CAAA;AAAA,IACrC;AAGA,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AAClB,MAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAAA,IAC7C;AAEA,IAAA,MAAM,eAAA,GAAkB,MAAM,cAAA,CAAe,QAAA,EAAU,KAAK,QAAQ,CAAA;AACpE,IAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,MAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAAA,IAC7C;AAGA,IAAA,MAAM,EAAA,CAAG,KAAK,MAAA,CAAO;AAAA,MACnB,KAAA,EAAO,EAAE,EAAA,EAAI,IAAA,CAAK,EAAA,EAAG;AAAA,MACrB,IAAA,EAAM,EAAE,WAAA,kBAAa,IAAI,MAAK;AAAE,KACjC,CAAA;AAGD,IAAA,OAAO;AAAA,MACL,IAAI,IAAA,CAAK,EAAA;AAAA,MACT,IAAA,EAAM,KAAK,IAAA,IAAQ,EAAA;AAAA,MACnB,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,MAAA,EAAQ,KAAK,MAAA,IAAU,IAAA;AAAA,MACvB,MAAA,EAAQ;AAAA,KACV;AAAA,EACF,SAAS,KAAA,EAAO;AAEd,IAAA,IAAI,iBAAiB,KAAA,EAAO;AAC1B,MAAA,MAAM,KAAA;AAAA,IACR;AACA,IAAA,MAAM,IAAI,MAAM,kBAAkB,CAAA;AAAA,EACpC;AACF;;;ACpDA,IAAM,eAAA,GAAkB,OAAA;AACxB,IAAM,cACJ,OAAA,CAAQ,GAAA,CAAI,gBAAgB,MAAA,IAAU,OAAA,CAAQ,IAAI,WAAA,KAAgB,GAAA;AAGpE,IAAM,YAAA,GAAuC;AAAA,EAC3C,MAAA,EAAQ,QAAA;AAAA,EACR,IAAA,EAAM,MAAA;AAAA,EACN,MAAA,EAAQ,QAAA;AAAA,EACR,MAAA,EAAQ,QAAA;AAAA,EACR,MAAA,EAAQ,QAAA;AAAA,EACR,MAAA,EAAQ,QAAA;AAAA,EACR,OAAA,EAAS,SAAA;AAAA,EACT,MAAA,EAAQ;AACV,CAAA;AAKO,SAAS,cAAc,MAAA,EAAwB;AACpD,EAAA,OAAO,YAAA,CAAa,MAAM,CAAA,IAAK,MAAA;AACjC;AASO,SAAS,mBAAmB,OAAA,EAAuC;AACxE,EAAA,IAAI,CAAC,OAAA,EAAS,IAAA,EAAM,OAAO,EAAC;AAC5B,EAAA,MAAM,OAAO,OAAA,CAAQ,IAAA;AAErB,EAAA,IAAI,CAAC,KAAK,WAAA,EAAa;AACrB,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,OAAO,IAAA,CAAK,WAAA;AACd;AAKO,SAAS,6BAAA,CACd,SACA,MAAA,EACsB;AAEtB,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,IAAA;AAAA,MACR,IAAA,EAAM,IAAA;AAAA,MACN,MAAA,EAAQ,IAAA;AAAA,MACR,MAAA,EAAQ,IAAA;AAAA,MACR,MAAA,EAAQ,IAAA;AAAA,MACR,MAAA,EAAQ,IAAA;AAAA,MACR,OAAA,EAAS,IAAA;AAAA,MACT,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,SAAS,IAAA,EAAM;AAClB,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,KAAA;AAAA,MACN,MAAA,EAAQ,KAAA;AAAA,MACR,MAAA,EAAQ,KAAA;AAAA,MACR,MAAA,EAAQ,KAAA;AAAA,MACR,MAAA,EAAQ,KAAA;AAAA,MACR,OAAA,EAAS,KAAA;AAAA,MACT,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AAEA,EAAA,MAAM,OAAO,OAAA,CAAQ,IAAA;AAErB,EAAA,IAAI,CAAC,KAAK,EAAA,EAAI;AACZ,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,KAAA;AAAA,MACN,MAAA,EAAQ,KAAA;AAAA,MACR,MAAA,EAAQ,KAAA;AAAA,MACR,MAAA,EAAQ,KAAA;AAAA,MACR,MAAA,EAAQ,KAAA;AAAA,MACR,OAAA,EAAS,KAAA;AAAA,MACT,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AAGA,EAAA,MAAMA,QAAAA,GACJ,KAAK,KAAA,EAAO,QAAA,CAAS,eAAe,CAAA,IACpC,IAAA,CAAK,KAAA,EAAO,QAAA,CAAS,aAAa,CAAA;AACpC,EAAA,IAAIA,QAAAA,EAAS;AACX,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,IAAA;AAAA,MACR,IAAA,EAAM,IAAA;AAAA,MACN,MAAA,EAAQ,IAAA;AAAA,MACR,MAAA,EAAQ,IAAA;AAAA,MACR,MAAA,EAAQ,IAAA;AAAA,MACR,MAAA,EAAQ,IAAA;AAAA,MACR,OAAA,EAAS,IAAA;AAAA,MACT,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AAGA,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,WAAA,IAAe,EAAC;AACzC,EAAA,MAAM,iBAAiB,IAAI,GAAA;AAAA,IACzB,WAAA,CAAY,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,EAAG,EAAE,YAAY,CAAA,CAAA,EAAI,CAAA,CAAE,UAAU,CAAA,CAAE;AAAA,GAC5D;AAEA,EAAA,MAAMC,cAAAA,GAAgB,CAAC,MAAA,KAAmB;AACxC,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA;AAC/B,IAAA,OAAO,cAAA,CAAe,IAAI,GAAG,CAAA;AAAA,EAC/B,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,MAAA,EAAQA,cAAAA,CAAc,aAAA,CAAc,QAAQ,CAAC,CAAA;AAAA,IAC7C,IAAA,EAAMA,cAAAA,CAAc,aAAA,CAAc,MAAM,CAAC,CAAA;AAAA,IACzC,MAAA,EAAQA,cAAAA,CAAc,aAAA,CAAc,QAAQ,CAAC,CAAA;AAAA,IAC7C,MAAA,EAAQA,cAAAA,CAAc,aAAA,CAAc,QAAQ,CAAC,CAAA;AAAA,IAC7C,MAAA,EAAQA,cAAAA,CAAc,aAAA,CAAc,QAAQ,CAAC,CAAA;AAAA,IAC7C,MAAA,EAAQA,cAAAA,CAAc,aAAA,CAAc,QAAQ,CAAC,CAAA;AAAA,IAC7C,OAAA,EAASA,cAAAA,CAAc,aAAA,CAAc,SAAS,CAAC,CAAA;AAAA,IAC/C,MAAA,EAAQA,cAAAA,CAAc,aAAA,CAAc,QAAQ,CAAC;AAAA,GAC/C;AACF;AAKO,SAAS,eAAA,CACd,OAAA,EACA,YAAA,EACA,UAAA,EACS;AACT,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI,CAAC,OAAA,EAAS,IAAA,EAAM,OAAO,KAAA;AAC3B,EAAA,MAAM,OAAO,OAAA,CAAQ,IAAA;AAErB,EAAA,IAAI,CAAC,IAAA,CAAK,WAAA,IAAe,IAAA,CAAK,WAAA,CAAY,WAAW,CAAA,EAAG;AACtD,IAAA,OAAO,KAAA;AAAA,EACT;AAGA,EAAA,IACE,IAAA,CAAK,OAAO,QAAA,CAAS,eAAe,KACpC,IAAA,CAAK,KAAA,EAAO,QAAA,CAAS,aAAa,CAAA,EAClC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,OAAO,KAAK,WAAA,CAAY,IAAA;AAAA,IACtB,CAAC,CAAA,KAAM,CAAA,CAAE,YAAA,KAAiB,YAAA,IAAgB,EAAE,UAAA,KAAe;AAAA,GAC7D;AACF;AAKO,SAAS,aAAA,CACd,OAAA,EACA,YAAA,EACA,UAAA,EACS;AACT,EAAA,OAAO,eAAA,CAAgB,OAAA,EAAS,YAAA,EAAc,UAAU,CAAA;AAC1D;AAKO,SAAS,iBAAA,CACd,OAAA,EACA,YAAA,EACA,UAAA,EACM;AACN,EAAA,IAAI,CAAC,eAAA,CAAgB,OAAA,EAAS,YAAA,EAAc,UAAU,CAAA,EAAG;AACvD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,4CAAA,EAA+C,UAAU,CAAA,IAAA,EAAO,YAAY,CAAA;AAAA,KAC9E;AAAA,EACF;AACF;AAKO,SAAS,OAAA,CAAQ,SAAyB,QAAA,EAA2B;AAC1E,EAAA,IAAI,CAAC,OAAA,EAAS,IAAA,EAAM,OAAO,KAAA;AAC3B,EAAA,MAAM,OAAO,OAAA,CAAQ,IAAA;AAErB,EAAA,IAAI,CAAC,KAAK,KAAA,EAAO;AACf,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,QAAA,CAAS,QAAQ,CAAA;AACrC;AAKO,SAAS,UAAA,CACd,SACA,SAAA,EACS;AACT,EAAA,IAAI,CAAC,OAAA,EAAS,IAAA,EAAM,OAAO,KAAA;AAC3B,EAAA,MAAM,OAAO,OAAA,CAAQ,IAAA;AAErB,EAAA,IAAI,CAAC,KAAK,KAAA,EAAO;AACf,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,SAAA,CAAU,KAAK,CAAC,IAAA,KAAS,KAAK,KAAA,CAAO,QAAA,CAAS,IAAI,CAAC,CAAA;AAC5D;AAKO,SAAS,QAAQ,OAAA,EAAkC;AACxD,EAAA,OAAO,OAAA,CAAQ,SAAS,eAAe,CAAA;AACzC","file":"index.js","sourcesContent":["// Define the shape of the Prisma Client required by this service\nexport interface AuthPrismaClient {\n  user: any;\n}\n\n// Dynamic import bcryptjs to avoid Edge Runtime issues\nexport async function verifyPassword(\n  password: string,\n  hash: string,\n): Promise<boolean> {\n  try {\n    const bcrypt = await import(\"bcryptjs\");\n    return bcrypt.compareSync(password, hash);\n  } catch (error) {\n    console.error(\"Error verifying password\", error);\n    return false;\n  }\n}\n\nexport interface AuthenticatedUser {\n  id: string;\n  email: string | null;\n  name: string;\n  avatar: string | null;\n  status: string;\n}\n\nexport interface AuthError {\n  message: string;\n  email?: string;\n}\n\n/**\n * Authenticate user with email and password\n * Returns user data if successful, throws error if failed\n */\nexport async function authenticateUser(\n  db: AuthPrismaClient,\n  email: string,\n  password: string,\n): Promise<AuthenticatedUser> {\n  try {\n    // Query user from database by email\n    const user = await db.user.findUnique({\n      where: { email: email.toLowerCase().trim() },\n      select: {\n        id: true,\n        email: true,\n        name: true,\n        avatar: true,\n        password: true,\n        isActive: true,\n      },\n    });\n\n    // Check if user exists\n    if (!user) {\n      throw new Error(\"Invalid email or password\");\n    }\n\n    // Check if user account is suspended/inactive\n    if (!user.isActive) {\n      throw new Error(\"ACCOUNT_SUSPENDED\");\n    }\n\n    // Verify password\n    if (!user.password) {\n      throw new Error(\"Invalid email or password\");\n    }\n\n    const isPasswordValid = await verifyPassword(password, user.password);\n    if (!isPasswordValid) {\n      throw new Error(\"Invalid email or password\");\n    }\n\n    // Update last login time\n    await db.user.update({\n      where: { id: user.id },\n      data: { lastLoginAt: new Date() },\n    });\n\n    // Return user data (without password)\n    return {\n      id: user.id,\n      name: user.name || \"\",\n      email: user.email,\n      avatar: user.avatar || null,\n      status: \"ONLINE\",\n    };\n  } catch (error) {\n    // Re-throw error with proper message\n    if (error instanceof Error) {\n      throw error;\n    }\n    throw new Error(\"Error signing in\");\n  }\n}\n","// @goerp/core/auth\n// Authentication and RBAC utilities for GoERP\n\nimport type { Session } from \"next-auth\";\n\nexport * from \"./auth-service\";\n\n// ============================================================================\n// Types\n// ============================================================================\n\nexport interface Permission {\n  resourceCode: string;\n  actionCode: string;\n}\n\nexport interface ExtendedUser {\n  id: string;\n  name?: string | null;\n  email?: string | null;\n  image?: string | null;\n  roles?: string[];\n  permissions?: Permission[];\n}\n\nexport interface UserSession {\n  user: ExtendedUser;\n}\n\nexport interface CrudPermissionResult {\n  create: boolean;\n  view: boolean;\n  update: boolean;\n  delete: boolean;\n  export: boolean;\n  import: boolean;\n  approve: boolean;\n  reject: boolean;\n}\n\n// ============================================================================\n// Constants\n// ============================================================================\n\nconst ADMIN_ROLE_CODE = \"admin\";\nconst BYPASS_AUTH =\n  process.env.BYPASS_AUTH === \"true\" || process.env.BYPASS_AUTH === \"1\";\n\n// Action code mapping\nconst ACTION_CODES: Record<string, string> = {\n  create: \"create\",\n  view: \"view\",\n  update: \"update\",\n  delete: \"delete\",\n  export: \"export\",\n  import: \"import\",\n  approve: \"approve\",\n  reject: \"reject\",\n};\n\n/**\n * Get action code from action name\n */\nexport function getActionCode(action: string): string {\n  return ACTION_CODES[action] || action;\n}\n\n// ============================================================================\n// Permission Functions\n// ============================================================================\n\n/**\n * Get all permissions from session\n */\nexport function getUserPermissions(session: Session | null): Permission[] {\n  if (!session?.user) return [];\n  const user = session.user as ExtendedUser;\n\n  if (!user.permissions) {\n    return [];\n  }\n  return user.permissions;\n}\n\n/**\n * Get CRUD permissions from session for a specific entity\n */\nexport function getCrudPermissionsFromSession(\n  session: Session | null,\n  entity: string,\n): CrudPermissionResult {\n  // TEMPORARY: Return all permissions as true if bypass is enabled\n  if (BYPASS_AUTH) {\n    return {\n      create: true,\n      view: true,\n      update: true,\n      delete: true,\n      export: true,\n      import: true,\n      approve: true,\n      reject: true,\n    };\n  }\n\n  if (!session?.user) {\n    return {\n      create: false,\n      view: false,\n      update: false,\n      delete: false,\n      export: false,\n      import: false,\n      approve: false,\n      reject: false,\n    };\n  }\n\n  const user = session.user as ExtendedUser;\n\n  if (!user.id) {\n    return {\n      create: false,\n      view: false,\n      update: false,\n      delete: false,\n      export: false,\n      import: false,\n      approve: false,\n      reject: false,\n    };\n  }\n\n  // Check admin role first (fastest check)\n  const isAdmin =\n    user.roles?.includes(ADMIN_ROLE_CODE) ||\n    user.roles?.includes(\"SUPER_ADMIN\");\n  if (isAdmin) {\n    return {\n      create: true,\n      view: true,\n      update: true,\n      delete: true,\n      export: true,\n      import: true,\n      approve: true,\n      reject: true,\n    };\n  }\n\n  // Pre-compute permission keys for fast lookup\n  const permissions = user.permissions || [];\n  const permissionKeys = new Set(\n    permissions.map((p) => `${p.resourceCode}:${p.actionCode}`),\n  );\n\n  const hasPermission = (action: string) => {\n    const key = `${entity}:${action}`;\n    return permissionKeys.has(key);\n  };\n\n  return {\n    create: hasPermission(getActionCode(\"create\")),\n    view: hasPermission(getActionCode(\"view\")),\n    update: hasPermission(getActionCode(\"update\")),\n    delete: hasPermission(getActionCode(\"delete\")),\n    export: hasPermission(getActionCode(\"export\")),\n    import: hasPermission(getActionCode(\"import\")),\n    approve: hasPermission(getActionCode(\"approve\")),\n    reject: hasPermission(getActionCode(\"reject\")),\n  };\n}\n\n/**\n * Check if user has a specific permission\n */\nexport function checkPermission(\n  session: Session | null,\n  resourceCode: string,\n  actionCode: string,\n): boolean {\n  if (BYPASS_AUTH) {\n    return true;\n  }\n\n  if (!session?.user) return false;\n  const user = session.user as ExtendedUser;\n\n  if (!user.permissions || user.permissions.length === 0) {\n    return false;\n  }\n\n  // Admin role bypass\n  if (\n    user.roles?.includes(ADMIN_ROLE_CODE) ||\n    user.roles?.includes(\"SUPER_ADMIN\")\n  ) {\n    return true;\n  }\n\n  return user.permissions.some(\n    (p) => p.resourceCode === resourceCode && p.actionCode === actionCode,\n  );\n}\n\n/**\n * Alias for checkPermission\n */\nexport function hasPermission(\n  session: Session | null,\n  resourceCode: string,\n  actionCode: string,\n): boolean {\n  return checkPermission(session, resourceCode, actionCode);\n}\n\n/**\n * Require permission - throw error if not authorized\n */\nexport function requirePermission(\n  session: Session | null,\n  resourceCode: string,\n  actionCode: string,\n): void {\n  if (!checkPermission(session, resourceCode, actionCode)) {\n    throw new Error(\n      `Unauthorized: User does not have permission ${actionCode} on ${resourceCode}`,\n    );\n  }\n}\n\n/**\n * Check if user has a specific role\n */\nexport function hasRole(session: Session | null, roleCode: string): boolean {\n  if (!session?.user) return false;\n  const user = session.user as ExtendedUser;\n\n  if (!user.roles) {\n    return false;\n  }\n  return user.roles.includes(roleCode);\n}\n\n/**\n * Check if user has any of the specified roles\n */\nexport function hasAnyRole(\n  session: Session | null,\n  roleCodes: string[],\n): boolean {\n  if (!session?.user) return false;\n  const user = session.user as ExtendedUser;\n\n  if (!user.roles) {\n    return false;\n  }\n  return roleCodes.some((role) => user.roles!.includes(role));\n}\n\n/**\n * Check if user is admin\n */\nexport function isAdmin(session: Session | null): boolean {\n  return hasRole(session, ADMIN_ROLE_CODE);\n}\n"]}

package/dist/auth/index.mjs

@@ -0,0 +1,198 @@
+// src/auth/auth-service.ts
+async function verifyPassword(password, hash) {
+  try {
+    const bcrypt = await import('bcryptjs');
+    return bcrypt.compareSync(password, hash);
+  } catch (error) {
+    console.error("Error verifying password", error);
+    return false;
+  }
+}
+async function authenticateUser(db, email, password) {
+  try {
+    const user = await db.user.findUnique({
+      where: { email: email.toLowerCase().trim() },
+      select: {
+        id: true,
+        email: true,
+        name: true,
+        avatar: true,
+        password: true,
+        isActive: true
+      }
+    });
+    if (!user) {
+      throw new Error("Invalid email or password");
+    }
+    if (!user.isActive) {
+      throw new Error("ACCOUNT_SUSPENDED");
+    }
+    if (!user.password) {
+      throw new Error("Invalid email or password");
+    }
+    const isPasswordValid = await verifyPassword(password, user.password);
+    if (!isPasswordValid) {
+      throw new Error("Invalid email or password");
+    }
+    await db.user.update({
+      where: { id: user.id },
+      data: { lastLoginAt: /* @__PURE__ */ new Date() }
+    });
+    return {
+      id: user.id,
+      name: user.name || "",
+      email: user.email,
+      avatar: user.avatar || null,
+      status: "ONLINE"
+    };
+  } catch (error) {
+    if (error instanceof Error) {
+      throw error;
+    }
+    throw new Error("Error signing in");
+  }
+}
+
+// src/auth/index.ts
+var ADMIN_ROLE_CODE = "admin";
+var BYPASS_AUTH = process.env.BYPASS_AUTH === "true" || process.env.BYPASS_AUTH === "1";
+var ACTION_CODES = {
+  create: "create",
+  view: "view",
+  update: "update",
+  delete: "delete",
+  export: "export",
+  import: "import",
+  approve: "approve",
+  reject: "reject"
+};
+function getActionCode(action) {
+  return ACTION_CODES[action] || action;
+}
+function getUserPermissions(session) {
+  if (!session?.user) return [];
+  const user = session.user;
+  if (!user.permissions) {
+    return [];
+  }
+  return user.permissions;
+}
+function getCrudPermissionsFromSession(session, entity) {
+  if (BYPASS_AUTH) {
+    return {
+      create: true,
+      view: true,
+      update: true,
+      delete: true,
+      export: true,
+      import: true,
+      approve: true,
+      reject: true
+    };
+  }
+  if (!session?.user) {
+    return {
+      create: false,
+      view: false,
+      update: false,
+      delete: false,
+      export: false,
+      import: false,
+      approve: false,
+      reject: false
+    };
+  }
+  const user = session.user;
+  if (!user.id) {
+    return {
+      create: false,
+      view: false,
+      update: false,
+      delete: false,
+      export: false,
+      import: false,
+      approve: false,
+      reject: false
+    };
+  }
+  const isAdmin2 = user.roles?.includes(ADMIN_ROLE_CODE) || user.roles?.includes("SUPER_ADMIN");
+  if (isAdmin2) {
+    return {
+      create: true,
+      view: true,
+      update: true,
+      delete: true,
+      export: true,
+      import: true,
+      approve: true,
+      reject: true
+    };
+  }
+  const permissions = user.permissions || [];
+  const permissionKeys = new Set(
+    permissions.map((p) => `${p.resourceCode}:${p.actionCode}`)
+  );
+  const hasPermission2 = (action) => {
+    const key = `${entity}:${action}`;
+    return permissionKeys.has(key);
+  };
+  return {
+    create: hasPermission2(getActionCode("create")),
+    view: hasPermission2(getActionCode("view")),
+    update: hasPermission2(getActionCode("update")),
+    delete: hasPermission2(getActionCode("delete")),
+    export: hasPermission2(getActionCode("export")),
+    import: hasPermission2(getActionCode("import")),
+    approve: hasPermission2(getActionCode("approve")),
+    reject: hasPermission2(getActionCode("reject"))
+  };
+}
+function checkPermission(session, resourceCode, actionCode) {
+  if (BYPASS_AUTH) {
+    return true;
+  }
+  if (!session?.user) return false;
+  const user = session.user;
+  if (!user.permissions || user.permissions.length === 0) {
+    return false;
+  }
+  if (user.roles?.includes(ADMIN_ROLE_CODE) || user.roles?.includes("SUPER_ADMIN")) {
+    return true;
+  }
+  return user.permissions.some(
+    (p) => p.resourceCode === resourceCode && p.actionCode === actionCode
+  );
+}
+function hasPermission(session, resourceCode, actionCode) {
+  return checkPermission(session, resourceCode, actionCode);
+}
+function requirePermission(session, resourceCode, actionCode) {
+  if (!checkPermission(session, resourceCode, actionCode)) {
+    throw new Error(
+      `Unauthorized: User does not have permission ${actionCode} on ${resourceCode}`
+    );
+  }
+}
+function hasRole(session, roleCode) {
+  if (!session?.user) return false;
+  const user = session.user;
+  if (!user.roles) {
+    return false;
+  }
+  return user.roles.includes(roleCode);
+}
+function hasAnyRole(session, roleCodes) {
+  if (!session?.user) return false;
+  const user = session.user;
+  if (!user.roles) {
+    return false;
+  }
+  return roleCodes.some((role) => user.roles.includes(role));
+}
+function isAdmin(session) {
+  return hasRole(session, ADMIN_ROLE_CODE);
+}
+
+export { authenticateUser, checkPermission, getActionCode, getCrudPermissionsFromSession, getUserPermissions, hasAnyRole, hasPermission, hasRole, isAdmin, requirePermission, verifyPassword };
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map