@goplusvn/core 0.1.6 → 0.1.7

package/CHANGELOG.md

@@ -1,6 +1,18 @@
 # Changelog
 
-## Unreleased — platform foundation extraction
+## 0.1.7 — auth hardening
+
+Hardened `@goerp/core/auth` so the Vinh Hoa app (and others) can consolidate
+their hand-copied RBAC clones onto core without regressing two safety behaviors:
+
+- **Bypass is dev-only.** `BYPASS_AUTH` now requires `NODE_ENV !== "production"`,
+  so a `BYPASS_AUTH=1` env left set on a prod deploy can no longer disable all
+  permission checks.
+- **Admin-before-empty-permissions.** `checkPermission` now evaluates the
+  admin-role bypass BEFORE the empty-permissions guard, so an admin who relies on
+  their role (no explicit permission rows) is no longer denied everything.
+
+## 0.1.6 — platform foundation extraction
 
 Promoted the cross-cutting platform layer out of the Vinh Hoa reference app into
 core so every app inherits the same design system + infrastructure and only

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@goplusvn/core",
   "description": "GoPlusVN Platform Kit - ERP kernel: layout, RBAC, CRUD, multi-tenant, system pages",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "private": false,
   "publishConfig": {
     "registry": "https://registry.npmjs.org",

package/src/auth/index.ts

@@ -43,8 +43,11 @@ export interface CrudPermissionResult {
 // ============================================================================
 
 const ADMIN_ROLE_CODE = "admin";
+// Auth bypass is a DEV-ONLY escape hatch — never allow it in production, even if
+// the env var is accidentally left set on a prod deploy.
 const BYPASS_AUTH =
-  process.env.BYPASS_AUTH === "true" || process.env.BYPASS_AUTH === "1";
+  process.env.NODE_ENV !== "production" &&
+  (process.env.BYPASS_AUTH === "true" || process.env.BYPASS_AUTH === "1");
 
 // Action code mapping
 const ACTION_CODES: Record<string, string> = {
@@ -186,11 +189,8 @@ export function checkPermission(
   if (!session?.user) return false;
   const user = session.user as ExtendedUser;
 
-  if (!user.permissions || user.permissions.length === 0) {
-    return false;
-  }
-
-  // Admin role bypass
+  // Admin role bypass — checked BEFORE the empty-permissions guard so an admin
+  // who relies on their role (no explicit permission rows) is not locked out.
   if (
     user.roles?.includes(ADMIN_ROLE_CODE) ||
     user.roles?.includes("SUPER_ADMIN")
@@ -198,6 +198,10 @@ export function checkPermission(
     return true;
   }
 
+  if (!user.permissions || user.permissions.length === 0) {
+    return false;
+  }
+
   return user.permissions.some(
     (p) => p.resourceCode === resourceCode && p.actionCode === actionCode,
   );