@grest-ts/http 0.0.34 → 0.0.36
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +24 -0
- package/dist/src/_dedupCheck.js +1 -1
- package/dist/src/index-node.d.ts +1 -0
- package/dist/src/index-node.d.ts.map +1 -1
- package/dist/src/index-node.js +1 -0
- package/dist/src/index-node.js.map +1 -1
- package/dist/src/server/GGHttp.d.ts +24 -0
- package/dist/src/server/GGHttp.d.ts.map +1 -1
- package/dist/src/server/GGHttp.js +19 -1
- package/dist/src/server/GGHttp.js.map +1 -1
- package/dist/src/server/GGHttpSchema.startServer.d.ts +7 -0
- package/dist/src/server/GGHttpSchema.startServer.d.ts.map +1 -1
- package/dist/src/server/GGHttpSchema.startServer.js +20 -1
- package/dist/src/server/GGHttpSchema.startServer.js.map +1 -1
- package/dist/src/server/GGHttpServer.d.ts +11 -1
- package/dist/src/server/GGHttpServer.d.ts.map +1 -1
- package/dist/src/server/GGHttpServer.js +68 -0
- package/dist/src/server/GGHttpServer.js.map +1 -1
- package/dist/src/server/GG_PERMISSIONS.d.ts +15 -0
- package/dist/src/server/GG_PERMISSIONS.d.ts.map +1 -0
- package/dist/src/server/GG_PERMISSIONS.js +15 -0
- package/dist/src/server/GG_PERMISSIONS.js.map +1 -0
- package/dist/tsconfig.publish.tsbuildinfo +1 -1
- package/package.json +10 -10
- package/src/_dedupCheck.ts +1 -1
- package/src/index-node.ts +1 -0
- package/src/server/GGHttp.ts +35 -1
- package/src/server/GGHttpSchema.startServer.ts +24 -1
- package/src/server/GGHttpServer.ts +84 -1
- package/src/server/GG_PERMISSIONS.ts +15 -0
package/README.md
CHANGED
|
@@ -166,6 +166,30 @@ export const MyApiContract = new GGContractClass("MyApi", {
|
|
|
166
166
|
})
|
|
167
167
|
```
|
|
168
168
|
|
|
169
|
+
## Permissions
|
|
170
|
+
|
|
171
|
+
Contract methods may declare a `permission`. The framework gates every request against the declared permission **before the handler runs**, so missing or wrong scopes can never reach service code. Declarations are opt-in but *infectious*: once any route on the server declares one (or `.usePermissions(...)` is wired), every route on the server must declare — the runtime refuses to start otherwise (see "Hard guarantee" below).
|
|
172
|
+
|
|
173
|
+
The wiring chain is read top-to-bottom:
|
|
174
|
+
|
|
175
|
+
```typescript
|
|
176
|
+
new GGHttp(httpServer)
|
|
177
|
+
.use(new JwtAuthMiddleware(secret)) // parses the token → context
|
|
178
|
+
.usePermissions(getScopes) // reads context → scope set
|
|
179
|
+
.http(ItemApi, new ItemApiImpl())
|
|
180
|
+
```
|
|
181
|
+
|
|
182
|
+
Each step has one job: the auth middleware turns a token into identity in context; the scope resolver (a zero-arg `() => ReadonlySet<string> | null`, sync or async) extracts the caller's scopes from that context; the gate calls the resolver, checks `satisfies(method.permission, scopes)`, and throws `NOT_AUTHORIZED` (no identity) or `FORBIDDEN` (wrong scopes). Order matters — `.usePermissions(...)` must come before the `.http(...)` calls it should apply to.
|
|
183
|
+
|
|
184
|
+
**Hard guarantee.** At server start the framework walks every HTTP / WS route registered on the `GGHttpServer`. If any of them declared a permission, or any chain wired `.usePermissions(...)`, **strict mode** is on for the whole server. In strict mode:
|
|
185
|
+
|
|
186
|
+
- Every route must declare `permission` — use `GG_NO_PERMISSIONS` for intentionally public ones. Routes that omit it fail the start and are listed by name.
|
|
187
|
+
- A route declaring a non-public permission without a resolver on its registering chain also fails the start.
|
|
188
|
+
|
|
189
|
+
The check is per-server (HTTP routes + WS schemas on the same `GGHttpServer`), so a permission declared anywhere is infectious across sibling chains. The only way to opt out is to declare nothing — projects with no auth pay zero ceremony, but the moment one route opts in, the framework forces consistency.
|
|
190
|
+
|
|
191
|
+
**What this does not cover.** The permission gates *endpoint access* — "is this caller allowed to invoke this method at all?" It does not handle *resource access* — "can this caller edit *this specific* post?" That check still belongs in the handler. The same `GGPermissionChecker` the gate used is exposed via `GG_PERMISSIONS.get()`, so handler-side sub-decisions use identical logic with no drift between framework and app code.
|
|
192
|
+
|
|
169
193
|
## Authentication & Context
|
|
170
194
|
|
|
171
195
|
### Using Codec (Recommended for Header-Based Auth)
|
package/dist/src/_dedupCheck.js
CHANGED
|
@@ -11,7 +11,7 @@
|
|
|
11
11
|
const __KEY = Symbol.for("grest-ts:dedup:@grest-ts/http");
|
|
12
12
|
const __slot = globalThis;
|
|
13
13
|
const __existing = __slot[__KEY];
|
|
14
|
-
const __here = { path: import.meta.url, version: "0.0.
|
|
14
|
+
const __here = { path: import.meta.url, version: "0.0.36" };
|
|
15
15
|
// Same path + same version means the same physical package is being
|
|
16
16
|
// re-evaluated by a different ESM runner (e.g. vitest projects share one
|
|
17
17
|
// process but each project has its own module cache). That isn't a true
|
package/dist/src/index-node.d.ts
CHANGED
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
import "./_dedupCheck";
|
|
2
2
|
export * from "./server/GGHttpMetrics";
|
|
3
3
|
export * from "./server/GG_HTTP_REQUEST";
|
|
4
|
+
export * from "./server/GG_PERMISSIONS";
|
|
4
5
|
export * from "./schema/GGHttpSchema";
|
|
5
6
|
export * from "./schema/httpSchema";
|
|
6
7
|
export * from "./rpc/GGHttpRouteRPC";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index-node.d.ts","sourceRoot":"","sources":["../../src/index-node.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,CAAC;AAWvB,cAAc,wBAAwB,CAAC;AAGvC,cAAc,0BAA0B,CAAC;
|
|
1
|
+
{"version":3,"file":"index-node.d.ts","sourceRoot":"","sources":["../../src/index-node.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,CAAC;AAWvB,cAAc,wBAAwB,CAAC;AAGvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AAGxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sCAAsC,CAAC;AACrD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,uCAAuC,CAAC;AAGtD,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AAGxC,cAAc,oCAAoC,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAIlD,OAAO,oCAAoC,CAAC;AAC5C,OAAO,mCAAmC,CAAC"}
|
package/dist/src/index-node.js
CHANGED
|
@@ -11,6 +11,7 @@ _registerRpcServerCodecFactory((method, path, config) => ({
|
|
|
11
11
|
export * from "./server/GGHttpMetrics.js";
|
|
12
12
|
// Context
|
|
13
13
|
export * from "./server/GG_HTTP_REQUEST.js";
|
|
14
|
+
export * from "./server/GG_PERMISSIONS.js";
|
|
14
15
|
// API Schema
|
|
15
16
|
export * from "./schema/GGHttpSchema.js";
|
|
16
17
|
export * from "./schema/httpSchema.js";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index-node.js","sourceRoot":"","sources":["../../src/index-node.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,CAAC;AACvB,+EAA+E;AAC/E,OAAO,EAAC,8BAA8B,EAAC,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAC,oBAAoB,EAAC,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAC,kBAAkB,EAAC,MAAM,qCAAqC,CAAC;AACvE,8BAA8B,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACtD,YAAY,EAAE,IAAI,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,YAAY;IACvE,YAAY,EAAE,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAC,YAAY;CAC9D,CAAC,CAAC,CAAC;AAEJ,UAAU;AACV,cAAc,wBAAwB,CAAC;AAEvC,UAAU;AACV,cAAc,0BAA0B,CAAC;
|
|
1
|
+
{"version":3,"file":"index-node.js","sourceRoot":"","sources":["../../src/index-node.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,CAAC;AACvB,+EAA+E;AAC/E,OAAO,EAAC,8BAA8B,EAAC,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAC,oBAAoB,EAAC,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAC,kBAAkB,EAAC,MAAM,qCAAqC,CAAC;AACvE,8BAA8B,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACtD,YAAY,EAAE,IAAI,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,YAAY;IACvE,YAAY,EAAE,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAC,YAAY;CAC9D,CAAC,CAAC,CAAC;AAEJ,UAAU;AACV,cAAc,wBAAwB,CAAC;AAEvC,UAAU;AACV,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AAExC,aAAa;AACb,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sCAAsC,CAAC;AACrD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,uCAAuC,CAAC;AAEtD,+BAA+B;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AAExC,SAAS;AACT,cAAc,oCAAoC,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAGlD,aAAa;AACb,OAAO,oCAAoC,CAAC;AAC5C,OAAO,mCAAmC,CAAC"}
|
|
@@ -2,6 +2,19 @@ import { GGHttpSchema } from "../schema/GGHttpSchema";
|
|
|
2
2
|
import { GGContractApiDefinition, GGContractImplementation } from "@grest-ts/schema";
|
|
3
3
|
import { GGHttpServerMiddleware } from "./GGHttpSchema.startServer";
|
|
4
4
|
import { GGHttpServer } from "./GGHttpServer";
|
|
5
|
+
/**
|
|
6
|
+
* Resolves the caller's permission scopes for the current request. The function
|
|
7
|
+
* is called once between transport middleware and the handler. Sync or async —
|
|
8
|
+
* both supported (the gate awaits).
|
|
9
|
+
*
|
|
10
|
+
* Return `null` when no caller identity is available (the gate will throw
|
|
11
|
+
* NOT_AUTHORIZED for non-public methods). Return a (possibly empty) set
|
|
12
|
+
* otherwise; the gate will call satisfies() against the method's permission.
|
|
13
|
+
*
|
|
14
|
+
* The resolver should read whatever app-defined context the upstream auth
|
|
15
|
+
* middleware populated — it should NOT parse the token itself.
|
|
16
|
+
*/
|
|
17
|
+
export type GGScopeResolver = () => ReadonlySet<string> | null | Promise<ReadonlySet<string> | null>;
|
|
5
18
|
export declare class GGHttp<TContext = undefined> {
|
|
6
19
|
/**
|
|
7
20
|
* Protected (not private) so that plugin modules can access the underlying server
|
|
@@ -10,8 +23,19 @@ export declare class GGHttp<TContext = undefined> {
|
|
|
10
23
|
*/
|
|
11
24
|
protected readonly httpServer: GGHttpServer;
|
|
12
25
|
private readonly middlewares;
|
|
26
|
+
private permissionResolver?;
|
|
13
27
|
constructor(httpServer: GGHttpServer);
|
|
14
28
|
use<M extends GGHttpServerMiddleware>(middleware: M): GGHttp<TContext | M>;
|
|
29
|
+
/**
|
|
30
|
+
* Register a scope resolver. Subsequent .http(...) calls capture this
|
|
31
|
+
* resolver and use it to gate every request against the contract's
|
|
32
|
+
* declared `permission`.
|
|
33
|
+
*
|
|
34
|
+
* Calling order matters: .use(auth) → .usePermissions(getScopes) → .http(api).
|
|
35
|
+
* If .http() runs before .usePermissions(), the call sees no resolver — and
|
|
36
|
+
* the startup check will hard-fail if its schema has any non-public method.
|
|
37
|
+
*/
|
|
38
|
+
usePermissions(resolver: GGScopeResolver): this;
|
|
15
39
|
http<TContract extends GGContractApiDefinition, TSchemaContext>(schema: GGHttpSchema<TContract, TSchemaContext>, implementation: GGContractImplementation<TContract>): this;
|
|
16
40
|
}
|
|
17
41
|
//# sourceMappingURL=GGHttp.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"GGHttp.d.ts","sourceRoot":"","sources":["../../../src/server/GGHttp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,YAAY,EAAC,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAC,uBAAuB,EAAE,wBAAwB,EAAC,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAC,sBAAsB,EAAC,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAE5C,qBAAa,MAAM,CAAC,QAAQ,GAAG,SAAS;IAEpC;;;;OAIG;IACH,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAA;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgC;
|
|
1
|
+
{"version":3,"file":"GGHttp.d.ts","sourceRoot":"","sources":["../../../src/server/GGHttp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,YAAY,EAAC,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAC,uBAAuB,EAAE,wBAAwB,EAAC,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAC,sBAAsB,EAAC,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAE5C;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,eAAe,GACvB,MAAM,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAA;AAE1E,qBAAa,MAAM,CAAC,QAAQ,GAAG,SAAS;IAEpC;;;;OAIG;IACH,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAA;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgC;IAC5D,OAAO,CAAC,kBAAkB,CAAC,CAAkB;gBAEjC,UAAU,EAAE,YAAY;IAI7B,GAAG,CAAC,CAAC,SAAS,sBAAsB,EAAE,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;IAKjF;;;;;;;;OAQG;IACI,cAAc,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAK/C,IAAI,CAAC,SAAS,SAAS,uBAAuB,EAAE,cAAc,EACjE,MAAM,EAAE,YAAY,CAAC,SAAS,EAAE,cAAc,CAAC,EAC/C,cAAc,EAAE,wBAAwB,CAAC,SAAS,CAAC,GACpD,IAAI;CAQV"}
|
|
@@ -6,6 +6,7 @@ export class GGHttp {
|
|
|
6
6
|
*/
|
|
7
7
|
httpServer;
|
|
8
8
|
middlewares = [];
|
|
9
|
+
permissionResolver;
|
|
9
10
|
constructor(httpServer) {
|
|
10
11
|
this.httpServer = httpServer;
|
|
11
12
|
}
|
|
@@ -13,8 +14,25 @@ export class GGHttp {
|
|
|
13
14
|
this.middlewares.push(middleware);
|
|
14
15
|
return this;
|
|
15
16
|
}
|
|
17
|
+
/**
|
|
18
|
+
* Register a scope resolver. Subsequent .http(...) calls capture this
|
|
19
|
+
* resolver and use it to gate every request against the contract's
|
|
20
|
+
* declared `permission`.
|
|
21
|
+
*
|
|
22
|
+
* Calling order matters: .use(auth) → .usePermissions(getScopes) → .http(api).
|
|
23
|
+
* If .http() runs before .usePermissions(), the call sees no resolver — and
|
|
24
|
+
* the startup check will hard-fail if its schema has any non-public method.
|
|
25
|
+
*/
|
|
26
|
+
usePermissions(resolver) {
|
|
27
|
+
this.permissionResolver = resolver;
|
|
28
|
+
return this;
|
|
29
|
+
}
|
|
16
30
|
http(schema, implementation) {
|
|
17
|
-
schema.register(implementation, {
|
|
31
|
+
schema.register(implementation, {
|
|
32
|
+
http: this.httpServer,
|
|
33
|
+
middlewares: this.middlewares,
|
|
34
|
+
permissionResolver: this.permissionResolver,
|
|
35
|
+
});
|
|
18
36
|
return this;
|
|
19
37
|
}
|
|
20
38
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"GGHttp.js","sourceRoot":"","sources":["../../../src/server/GGHttp.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"GGHttp.js","sourceRoot":"","sources":["../../../src/server/GGHttp.ts"],"names":[],"mappings":"AAoBA,MAAM,OAAO,MAAM;IAEf;;;;OAIG;IACgB,UAAU,CAAc;IAC1B,WAAW,GAA6B,EAAE,CAAC;IACpD,kBAAkB,CAAmB;IAE7C,YAAY,UAAwB;QAChC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,CAAC;IAEM,GAAG,CAAmC,UAAa;QACtD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,OAAO,IAAW,CAAC;IACvB,CAAC;IAED;;;;;;;;OAQG;IACI,cAAc,CAAC,QAAyB;QAC3C,IAAI,CAAC,kBAAkB,GAAG,QAAQ,CAAC;QACnC,OAAO,IAAI,CAAC;IAChB,CAAC;IAEM,IAAI,CACP,MAA+C,EAC/C,cAAmD;QAEnD,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE;YAC5B,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;SAC9C,CAAC,CAAC;QACH,OAAO,IAAW,CAAC;IACvB,CAAC;CACJ"}
|
|
@@ -4,6 +4,7 @@
|
|
|
4
4
|
*/
|
|
5
5
|
import { GGContractApiDefinition, GGContractImplementation } from "@grest-ts/schema";
|
|
6
6
|
import { GGHttpServer } from "./GGHttpServer";
|
|
7
|
+
import type { GGScopeResolver } from "./GGHttp";
|
|
7
8
|
export interface GGHttpSchemaConfig {
|
|
8
9
|
/**
|
|
9
10
|
* The HTTP request handler to register with.
|
|
@@ -13,6 +14,12 @@ export interface GGHttpSchemaConfig {
|
|
|
13
14
|
* Additional middlewares to apply to all routes.
|
|
14
15
|
*/
|
|
15
16
|
middlewares?: GGHttpServerMiddleware[];
|
|
17
|
+
/**
|
|
18
|
+
* Optional scope resolver. When set, the gate calls it once per request,
|
|
19
|
+
* populates GG_PERMISSIONS, and rejects requests whose contract permission
|
|
20
|
+
* is not satisfied by the resolved scopes.
|
|
21
|
+
*/
|
|
22
|
+
permissionResolver?: GGScopeResolver;
|
|
16
23
|
}
|
|
17
24
|
export interface GGHttpServerMiddleware {
|
|
18
25
|
process?(): Promise<void>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"GGHttpSchema.startServer.d.ts","sourceRoot":"","sources":["../../../src/server/GGHttpSchema.startServer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,
|
|
1
|
+
{"version":3,"file":"GGHttpSchema.startServer.d.ts","sourceRoot":"","sources":["../../../src/server/GGHttpSchema.startServer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,EAA0D,uBAAuB,EAAE,wBAAwB,EAAqF,MAAM,kBAAkB,CAAC;AAShO,OAAO,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAG5C,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,UAAU,CAAC;AAE9C,MAAM,WAAW,kBAAkB;IAC/B;;OAEG;IACH,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB;;OAEG;IACH,WAAW,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACvC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,eAAe,CAAC;CACxC;AAED,MAAM,WAAW,sBAAsB;IACnC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAC5B;AAED,OAAO,QAAQ,wBAAwB,CAAC;IACpC,UAAU,YAAY,CAAC,SAAS,SAAS,uBAAuB;QAC5D;;;;WAIG;QACH,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAA;KACnG;CACJ"}
|
|
@@ -4,7 +4,7 @@
|
|
|
4
4
|
*/
|
|
5
5
|
import { GGLocator } from "@grest-ts/locator";
|
|
6
6
|
import { GGHttpSchema } from "../schema/GGHttpSchema.js";
|
|
7
|
-
import { ERROR, SERVER_ERROR } from "@grest-ts/schema";
|
|
7
|
+
import { describePermission, ERROR, FORBIDDEN, GG_NO_PERMISSIONS, GGPermissionChecker, NOT_AUTHORIZED, satisfies, SERVER_ERROR } from "@grest-ts/schema";
|
|
8
8
|
import { GG_DISCOVERY } from "@grest-ts/discovery";
|
|
9
9
|
import { GGContext, GGContextStore } from "@grest-ts/context";
|
|
10
10
|
import { GG_TRACE } from "@grest-ts/trace";
|
|
@@ -13,6 +13,7 @@ import { GG_METRICS } from "@grest-ts/metrics";
|
|
|
13
13
|
import { GGHttpMetrics } from "./GGHttpMetrics.js";
|
|
14
14
|
import { GG_HTTP_SERVER } from "./GG_HTTP_SERVER.js";
|
|
15
15
|
import { GGLog } from "@grest-ts/logger";
|
|
16
|
+
import { GG_PERMISSIONS } from "./GG_PERMISSIONS.js";
|
|
16
17
|
GGHttpSchema.prototype.register = function (implementation, config) {
|
|
17
18
|
return setupRoutes(this, implementation, config);
|
|
18
19
|
};
|
|
@@ -55,6 +56,8 @@ function setupRoutes(httpSchema, implementation, config) {
|
|
|
55
56
|
// Info: Contract instance is auto-registered in GGLocator via patched implement()
|
|
56
57
|
// @TODO This is not really used and only for testkit so it would register implementation of the contract... Not cool
|
|
57
58
|
httpSchema.contract.implement(implementation);
|
|
59
|
+
if (config.permissionResolver)
|
|
60
|
+
server._markResolverWired(httpSchema);
|
|
58
61
|
for (const methodName in httpSchema.codec) {
|
|
59
62
|
// Wire format.
|
|
60
63
|
const codec = httpSchema.codec[methodName];
|
|
@@ -84,6 +87,22 @@ function setupRoutes(httpSchema, implementation, config) {
|
|
|
84
87
|
try {
|
|
85
88
|
const rpcInput = await requestParser.parseRequest(req);
|
|
86
89
|
try {
|
|
90
|
+
if (config.permissionResolver) {
|
|
91
|
+
const scopes = await config.permissionResolver();
|
|
92
|
+
if (scopes != null)
|
|
93
|
+
GG_PERMISSIONS.set(new GGPermissionChecker(scopes));
|
|
94
|
+
const required = contractFunctionSchema.permission;
|
|
95
|
+
if (required !== undefined && required !== GG_NO_PERMISSIONS) {
|
|
96
|
+
if (scopes == null)
|
|
97
|
+
throw new NOT_AUTHORIZED({
|
|
98
|
+
debugMessage: `${httpSchema.name}.${methodName} requires ${describePermission(required)} but no caller identity was resolved`
|
|
99
|
+
});
|
|
100
|
+
if (!satisfies(required, scopes))
|
|
101
|
+
throw new FORBIDDEN({
|
|
102
|
+
debugMessage: `${httpSchema.name}.${methodName} requires ${describePermission(required)} — caller scopes did not satisfy`
|
|
103
|
+
});
|
|
104
|
+
}
|
|
105
|
+
}
|
|
87
106
|
rpcResult = { success: true, type: "OK", data: await implFn(rpcInput) };
|
|
88
107
|
// GGLog.debug(httpSchema, "Response", rpcResult) // This is very slow to log this (like 3x performance loss)
|
|
89
108
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"GGHttpSchema.startServer.js","sourceRoot":"","sources":["../../../src/server/GGHttpSchema.startServer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAC,SAAS,EAAC,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAwD,YAAY,EAAC,MAAM,wBAAwB,CAAC;AAC3G,OAAO,EAAC,KAAK,
|
|
1
|
+
{"version":3,"file":"GGHttpSchema.startServer.js","sourceRoot":"","sources":["../../../src/server/GGHttpSchema.startServer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAC,SAAS,EAAC,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAwD,YAAY,EAAC,MAAM,wBAAwB,CAAC;AAC3G,OAAO,EAAC,kBAAkB,EAAE,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAuE,mBAAmB,EAAE,cAAc,EAAM,SAAS,EAAE,YAAY,EAAC,MAAM,kBAAkB,CAAC;AAEhO,OAAO,EAAC,YAAY,EAAC,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAC,SAAS,EAAE,cAAc,EAAC,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAC,QAAQ,EAAC,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAC,eAAe,EAAC,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAC,UAAU,EAAC,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAC,aAAa,EAAC,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAC,cAAc,EAAC,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAC,KAAK,EAAC,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAC,cAAc,EAAC,MAAM,kBAAkB,CAAC;AAmChD,YAAY,CAAC,SAAS,CAAC,QAAQ,GAAG,UAE9B,cAAmD,EACnD,MAA2B;IAE3B,OAAO,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,CAAA;AACpD,CAAC,CAAA;AAED,SAAS,WAAW,CAChB,UAAmC,EACnC,cAAmD,EACnD,MAA2B;IAE3B,MAAM,KAAK,EAAE,CAAC;IACd,MAAM,CAAC,WAAW,KAAK,EAAE,CAAC;IAE1B,IAAI,CAAC,UAAU,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,UAAU,CAAC,IAAI,oBAAoB,CAAC,CAAC;IAEjG,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,yGAAyG,CAAC,CAAA;IAEvI,MAAM,CAAC,eAAe,CAAC,UAAoC,CAAC,CAAC;IAE7D,MAAM,UAAU,GAAG,GAAG,GAAG,UAAU,CAAC,UAAU,GAAG,GAAG,CAAA;IACpD,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;IACjD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC;IACnC,MAAM,aAAa,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;IAErD,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,KAAK,CAAC,MAAM;YAAE,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAChE,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,KAAK,GAAgB,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;QAChB,YAAY,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC;gBACnC,OAAO,EAAE,KAAK,CAAC,WAAW;gBAC1B,GAAG,EAAE,UAAU,CAAC,IAAI;gBACpB,UAAU,EAAE,UAAU;gBACtB,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,MAAM,CAAC,IAAI;aACpB,CAAC,CAAC,CAAC;IACR,CAAC,CAAC,CAAA;IAEF,kFAAkF;IAClF,qHAAqH;IACrH,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAE9C,IAAI,MAAM,CAAC,kBAAkB;QAAE,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAErE,KAAK,MAAM,UAAU,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QACxC,eAAe;QACf,MAAM,KAAK,GAAgB,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QACvD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,UAAU,CAAC,IAAI,IAAI,UAAU,2BAA2B,CAAC,CAAA;QAEtG,0BAA0B;QAC1B,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAA;QAC/D,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,UAAU,CAAC,IAAI,IAAI,UAAU,qCAAqC,CAAC,CAAA;QAEvH,eAAe;QACf,MAAM,sBAAsB,GAAqB,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,UAA6B,CAAC,CAAA;QAC3G,IAAI,CAAC,sBAAsB;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,UAAU,CAAC,IAAI,IAAI,UAAU,wCAAwC,CAAC,CAAA;QAEpI,wBAAwB;QACxB,MAAM,aAAa,GAA6C,KAAK,CAAC,eAAe,CAAC;YAClF,QAAQ,EAAE,sBAAsB;YAChC,cAAc,EAAE,cAAc;YAC9B,iBAAiB,EAAE,MAAM,CAAC,WAAW;SACxC,CAAC,CAAA;QACF,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAwB,EAAiB,EAAE;YACrI,KAAK,CAAC,aAAa,EAAE,CAAC;YACtB,OAAO,IAAI,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;gBACtD,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAChB,eAAe,CAAC,GAAG,CAAC,EAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,EAAC,CAAC,CAAC;gBAC5E,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;gBACnC,IAAI,SAA+C,CAAA;gBACnD,IAAI,CAAC;oBACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;oBACtD,IAAI,CAAC;wBACD,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;4BAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,kBAAkB,EAAE,CAAA;4BAChD,IAAI,MAAM,IAAI,IAAI;gCAAE,cAAc,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAA;4BACvE,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,CAAA;4BAClD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;gCAC3D,IAAI,MAAM,IAAI,IAAI;oCAAE,MAAM,IAAI,cAAc,CAAC;wCACzC,YAAY,EAAE,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,aAAa,kBAAkB,CAAC,QAAQ,CAAC,sCAAsC;qCAChI,CAAC,CAAA;gCACF,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC;oCAAE,MAAM,IAAI,SAAS,CAAC;wCAClD,YAAY,EAAE,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,aAAa,kBAAkB,CAAC,QAAQ,CAAC,kCAAkC;qCAC5H,CAAC,CAAA;4BACN,CAAC;wBACL,CAAC;wBACD,SAAS,GAAG,EAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAC,CAAA;wBACrE,6GAA6G;oBACjH,CAAC;oBAAC,OAAO,KAAc,EAAE,CAAC;wBACtB,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;wBACrC,IAAI,SAAS,YAAY,YAAY,IAAK,SAAoC,CAAC,eAAe,EAAE,EAAE,CAAC;4BAC/F,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;wBACtC,CAAC;oBACL,CAAC;oBACD,MAAM,aAAa,CAAC,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA,CAAC,YAAY;gBACjE,CAAC;gBAAC,OAAO,KAAc,EAAE,CAAC;oBACtB,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;oBACpC,MAAM,aAAa,CAAC,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA,CAAC,iBAAiB;oBAClE,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;gBACtC,CAAC;wBAAS,CAAC;oBACP,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;gBAC9F,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAA;IACN,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CACZ,UAAkB,EAClB,OAAe,EACf,MAAkB,EAClB,UAAkB,EAClB,UAAkB,EAClB,SAAiB;IAEjB,IAAI,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,MAAM,GAAG,GAAG,GAAG,UAAU,GAAG,UAAU,CAAC;QACpD,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE;YAC1B,GAAG,EAAE,OAAO;YACZ,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,UAAU;SACrB,CAAC,CAAC;QACH,aAAa,CAAC,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE;YACjE,GAAG,EAAE,OAAO;YACZ,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,IAAI;SACb,CAAC,CAAC;IACP,CAAC;AACL,CAAC"}
|
|
@@ -2,11 +2,17 @@ import http from "http";
|
|
|
2
2
|
import { HttpMethod } from "@grest-ts/common";
|
|
3
3
|
import { GGLocatorKey, GGLocatorScope } from "@grest-ts/locator";
|
|
4
4
|
import type { GGHttpSchema } from "../schema/GGHttpSchema";
|
|
5
|
+
import { GGContractMethod, GGPermission } from "@grest-ts/schema";
|
|
5
6
|
type AnyWebSocketSchema = {
|
|
6
7
|
name: string;
|
|
7
8
|
path: string;
|
|
8
|
-
contract:
|
|
9
|
+
contract: {
|
|
10
|
+
clientToServer: {
|
|
11
|
+
methods: Record<string, GGContractMethod>;
|
|
12
|
+
};
|
|
13
|
+
};
|
|
9
14
|
middlewares: readonly unknown[];
|
|
15
|
+
connectPermission?: GGPermission;
|
|
10
16
|
};
|
|
11
17
|
export interface GGHttpServerAdapterConfig {
|
|
12
18
|
key?: GGLocatorKey<GGHttpServer>;
|
|
@@ -76,6 +82,10 @@ export declare class GGHttpServer {
|
|
|
76
82
|
get registeredWebSocketSchemas(): ReadonlyArray<AnyWebSocketSchema>;
|
|
77
83
|
/** @internal Called by GGWebSocketSchema.startServer(). Do not call directly. */
|
|
78
84
|
_registerWebSocketSchema(schema: AnyWebSocketSchema): void;
|
|
85
|
+
private readonly _schemasWithResolver;
|
|
86
|
+
/** @internal Called by HTTP / WS register paths when a scope resolver is wired. */
|
|
87
|
+
_markResolverWired(schema: object): void;
|
|
88
|
+
private _checkPermissionsAtStart;
|
|
79
89
|
registerRoute(method: HttpMethod, path: string, handler: GGHttpRequestCallback): void;
|
|
80
90
|
start(): Promise<void>;
|
|
81
91
|
teardown(): Promise<void>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"GGHttpServer.d.ts","sourceRoot":"","sources":["../../../src/server/GGHttpServer.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAC,UAAU,EAAiB,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAY,YAAY,EAAE,cAAc,EAAuB,MAAM,mBAAmB,CAAC;AAIhG,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,wBAAwB,CAAC;
|
|
1
|
+
{"version":3,"file":"GGHttpServer.d.ts","sourceRoot":"","sources":["../../../src/server/GGHttpServer.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAC,UAAU,EAAiB,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAY,YAAY,EAAE,cAAc,EAAuB,MAAM,mBAAmB,CAAC;AAIhG,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAwC,gBAAgB,EAAE,YAAY,EAAC,MAAM,kBAAkB,CAAC;AAGvG,KAAK,kBAAkB,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE;QAAC,cAAc,EAAE;YAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;SAAC,CAAA;KAAC,CAAC;IACxE,WAAW,EAAE,SAAS,OAAO,EAAE,CAAC;IAChC,iBAAiB,CAAC,EAAE,YAAY,CAAC;CACpC,CAAC;AAEF,MAAM,WAAW,yBAAyB;IACtC,GAAG,CAAC,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,GAAG,CAAC,EAAE;QACF,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;QACtB,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;KACxB,CAAC;CACL;AAED,qBAAa,YAAY;IAErB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IACrD,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IACzC,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IACvC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IAExC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyB;IAClD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAyB;IAErD;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAgC;IAEnE;;;OAGG;IACH,IAAI,iBAAiB,IAAI,aAAa,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAE7D;IAED,SAAgB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;IACxC,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,MAAM,CAAyC;IAEvD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAoB;IAChE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsD;IACnF,OAAO,CAAC,iBAAiB,CAAwD;IAEjF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IACxD,OAAO,CAAC,uBAAuB,CAAc;gBAEjC,MAAM,CAAC,EAAE,yBAAyB;IAsD9C;;;OAGG;IACI,mBAAmB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAa5D;;;OAGG;IACI,yBAAyB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAalE;;;OAGG;IACH,IAAI,IAAI,IAAI,MAAM,GAAG,SAAS,CAE7B;IAMD,gFAAgF;IACzE,eAAe,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI;IAI5D,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAA4B;IAExE;;;OAGG;IACH,IAAI,0BAA0B,IAAI,aAAa,CAAC,kBAAkB,CAAC,CAElE;IAED,iFAAiF;IAC1E,wBAAwB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI;IAIjE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAqB;IAE1D,mFAAmF;IAC5E,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAI/C,OAAO,CAAC,wBAAwB;IAoEzB,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,IAAI;IAI/E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAgBtB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAgB/B,OAAO,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;IAKnD,UAAU,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;CAIhE;AAED,MAAM,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC"}
|
|
@@ -5,6 +5,7 @@ import { GGLocator, GGLocatorServiceType } from "@grest-ts/locator";
|
|
|
5
5
|
import { GG_HTTP_SERVER } from "./GG_HTTP_SERVER.js";
|
|
6
6
|
import { GGLog } from "@grest-ts/logger";
|
|
7
7
|
import findMyWay from "find-my-way";
|
|
8
|
+
import { describePermission, GG_NO_PERMISSIONS } from "@grest-ts/schema";
|
|
8
9
|
export class GGHttpServer {
|
|
9
10
|
_port;
|
|
10
11
|
teardownPromise;
|
|
@@ -144,11 +145,78 @@ export class GGHttpServer {
|
|
|
144
145
|
_registerWebSocketSchema(schema) {
|
|
145
146
|
this._registeredWebSocketSchemas.push(schema);
|
|
146
147
|
}
|
|
148
|
+
_schemasWithResolver = new Set();
|
|
149
|
+
/** @internal Called by HTTP / WS register paths when a scope resolver is wired. */
|
|
150
|
+
_markResolverWired(schema) {
|
|
151
|
+
this._schemasWithResolver.add(schema);
|
|
152
|
+
}
|
|
153
|
+
_checkPermissionsAtStart() {
|
|
154
|
+
const surfaces = [];
|
|
155
|
+
for (const schema of this._registeredSchemas) {
|
|
156
|
+
const resolverWired = this._schemasWithResolver.has(schema);
|
|
157
|
+
const methods = schema.contract?.methods ?? {};
|
|
158
|
+
for (const name of Object.keys(methods)) {
|
|
159
|
+
surfaces.push({
|
|
160
|
+
label: `${schema.name}.${name}`,
|
|
161
|
+
permission: methods[name].permission,
|
|
162
|
+
resolverWired,
|
|
163
|
+
});
|
|
164
|
+
}
|
|
165
|
+
}
|
|
166
|
+
for (const ws of this._registeredWebSocketSchemas) {
|
|
167
|
+
const resolverWired = this._schemasWithResolver.has(ws);
|
|
168
|
+
const methods = ws.contract.clientToServer.methods;
|
|
169
|
+
for (const name of Object.keys(methods)) {
|
|
170
|
+
surfaces.push({
|
|
171
|
+
label: `${ws.name}.${name}`,
|
|
172
|
+
permission: methods[name].permission,
|
|
173
|
+
resolverWired,
|
|
174
|
+
});
|
|
175
|
+
}
|
|
176
|
+
if (ws.connectPermission !== undefined) {
|
|
177
|
+
surfaces.push({
|
|
178
|
+
label: `${ws.name} (connectPermission)`,
|
|
179
|
+
permission: ws.connectPermission,
|
|
180
|
+
resolverWired,
|
|
181
|
+
});
|
|
182
|
+
}
|
|
183
|
+
}
|
|
184
|
+
let strict = false;
|
|
185
|
+
const undeclared = [];
|
|
186
|
+
const orphaned = [];
|
|
187
|
+
for (const s of surfaces) {
|
|
188
|
+
if (s.permission !== undefined || s.resolverWired)
|
|
189
|
+
strict = true;
|
|
190
|
+
if (s.permission === undefined)
|
|
191
|
+
undeclared.push(s);
|
|
192
|
+
else if (s.permission !== GG_NO_PERMISSIONS && !s.resolverWired)
|
|
193
|
+
orphaned.push(s);
|
|
194
|
+
}
|
|
195
|
+
if (!strict)
|
|
196
|
+
return;
|
|
197
|
+
if (undeclared.length > 0) {
|
|
198
|
+
const lines = undeclared.map(s => ` ${s.label}`).join("\n");
|
|
199
|
+
throw new Error(`GGHttpServer: permission strict mode is active on this server ` +
|
|
200
|
+
`(at least one route declares a permission or has .usePermissions(...) wired), ` +
|
|
201
|
+
`but the following routes have no \`permission\` declared:\n\n` +
|
|
202
|
+
lines +
|
|
203
|
+
`\n\nFix: declare \`permission\` on every route — use \`GG_NO_PERMISSIONS\` for intentionally public ones.`);
|
|
204
|
+
}
|
|
205
|
+
if (orphaned.length > 0) {
|
|
206
|
+
const lines = orphaned.map(s => ` ${s.label} requires ${describePermission(s.permission)}`).join("\n");
|
|
207
|
+
throw new Error(`GGHttpServer: these routes declare non-public permissions but their schema was ` +
|
|
208
|
+
`registered without a scope resolver:\n\n` +
|
|
209
|
+
lines +
|
|
210
|
+
`\n\nFix: call \`.usePermissions(yourResolver)\` on the GGHttp chain (or pass ` +
|
|
211
|
+
`\`permissionResolver\` to the WS schema config) before registering these routes.`);
|
|
212
|
+
}
|
|
213
|
+
}
|
|
147
214
|
registerRoute(method, path, handler) {
|
|
148
215
|
this.router.on(method, path, handler);
|
|
149
216
|
}
|
|
150
217
|
async start() {
|
|
151
218
|
Object.freeze(this._registeredSchemas);
|
|
219
|
+
this._checkPermissionsAtStart();
|
|
152
220
|
this._port = await new Promise((resolve) => {
|
|
153
221
|
this.httpServer.listen(this.configuredPort, '0.0.0.0', () => {
|
|
154
222
|
const port = this.httpServer.address().port;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"GGHttpServer.js","sourceRoot":"","sources":["../../../src/server/GGHttpServer.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAa,cAAc,EAAC,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAC,SAAS,EAAgC,oBAAoB,EAAC,MAAM,mBAAmB,CAAC;AAChG,OAAO,EAAC,cAAc,EAAC,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAC,KAAK,EAAC,MAAM,kBAAkB,CAAC;AACvC,OAAO,SAAuB,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"GGHttpServer.js","sourceRoot":"","sources":["../../../src/server/GGHttpServer.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAa,cAAc,EAAC,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAC,SAAS,EAAgC,oBAAoB,EAAC,MAAM,mBAAmB,CAAC;AAChG,OAAO,EAAC,cAAc,EAAC,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAC,KAAK,EAAC,MAAM,kBAAkB,CAAC;AACvC,OAAO,SAAuB,MAAM,aAAa,CAAC;AAElD,OAAO,EAAC,kBAAkB,EAAE,iBAAiB,EAAiC,MAAM,kBAAkB,CAAC;AA4BvG,MAAM,OAAO,YAAY;IAEX,KAAK,CAAqB;IAC1B,eAAe,CAA4B;IAClC,KAAK,CAAiB;IACtB,WAAW,CAAS;IACtB,cAAc,CAAS;IAEvB,QAAQ,GAAsB,EAAE,CAAC;IACjC,WAAW,GAAsB,EAAE,CAAC;IAErD;;;OAGG;IACc,kBAAkB,GAA6B,EAAE,CAAC;IAEnE;;;OAGG;IACH,IAAI,iBAAiB;QACjB,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACnC,CAAC;IAEe,UAAU,CAAc;IAChC,cAAc,GAAG,CAAC,CAAC;IACnB,MAAM,GAAG,SAAS,EAA4B,CAAC;IAE/C,MAAM,CAAU,oBAAoB,GAAG,CAAC,cAAc,CAAC,CAAC;IAC/C,YAAY,GAAG,IAAI,GAAG,CAAS,YAAY,CAAC,oBAAoB,CAAC,CAAC;IAC3E,iBAAiB,GAAW,YAAY,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEhE,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAChD,uBAAuB,GAAW,EAAE,CAAC;IAE7C,YAAY,MAAkC;QAE1C,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC;QACpD,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC,cAAc,GAAG,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAExF,SAAS,CAAC,QAAQ,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,IAAI,cAAc,EAAE,IAAI,EAAE;YACvE,IAAI,EAAE,oBAAoB,CAAC,IAAI;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;YAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;SACrC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,KAAK,EAAE,GAAyB,EAAE,GAAwB,EAAE,EAAE;YAC1E,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBACvB,GAAG,CAAC,UAAU,GAAG,cAAc,CAAC,gCAAgC,CAAC;gBACjE,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACX,CAAC;YACD,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,IAAI,CAAC;gBACD,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,eAAe;oBACrC,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;oBAClD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,wCAAwC,CAAC,CAAC;oBACxF,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;oBACtE,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC;wBAC/B,GAAG,CAAC,SAAS,CAAC,+BAA+B,EAAE,IAAI,CAAC,uBAAuB,CAAC,CAAC;oBACjF,CAAC;gBACL,CAAC;gBACD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC3B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACd,CAAC;qBAAM,CAAC;oBACJ,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAoB,EAAE,GAAG,CAAC,GAAG,CAAC,CAAA;oBACpE,IAAI,QAAQ,EAAE,CAAC;wBACX,MAAO,QAAQ,CAAC,OAA4C,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBAC3E,CAAC;yBAAM,CAAC;wBACJ,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;wBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;oBACd,CAAC;gBACL,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACzB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACd,CAAC;oBAAS,CAAC;gBACP,IAAI,CAAC,cAAc,EAAE,CAAC;YAC1B,CAAC;QACL,CAAC,CAAC;QAEF,IAAI,CAAC,UAAU,GAAG,MAAM,EAAE,GAAG;YACzB,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,EAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAC,EAAE,OAAO,CAAC;YAC3E,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAED;;;OAGG;IACI,mBAAmB,CAAC,OAA0B;QACjD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACzB,OAAO,GAAG,IAAI,CAAC;YACnB,CAAC;QACL,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACV,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtE,CAAC;IACL,CAAC;IAED;;;OAGG;IACI,yBAAyB,CAAC,OAA0B;QACvD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC/B,OAAO,GAAG,IAAI,CAAC;YACnB,CAAC;QACL,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACV,IAAI,CAAC,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClF,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,IAAI,IAAI;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC;IACtB,CAAC;IAED,4EAA4E;IAC5E,wBAAwB;IACxB,4EAA4E;IAE5E,gFAAgF;IACzE,eAAe,CAAC,MAA8B;QACjD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAEgB,2BAA2B,GAAyB,EAAE,CAAC;IAExE;;;OAGG;IACH,IAAI,0BAA0B;QAC1B,OAAO,IAAI,CAAC,2BAA2B,CAAC;IAC5C,CAAC;IAED,iFAAiF;IAC1E,wBAAwB,CAAC,MAA0B;QACtD,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAEgB,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1D,mFAAmF;IAC5E,kBAAkB,CAAC,MAAc;QACpC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAEO,wBAAwB;QAE5B,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC;YAC/C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,QAAQ,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE;oBAC/B,UAAU,EAAG,OAAO,CAAC,IAAI,CAAsB,CAAC,UAAU;oBAC1D,aAAa;iBAChB,CAAC,CAAC;YACP,CAAC;QACL,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,2BAA2B,EAAE,CAAC;YAChD,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC;YACnD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,QAAQ,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,IAAI,EAAE;oBAC3B,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU;oBACpC,aAAa;iBAChB,CAAC,CAAC;YACP,CAAC;YACD,IAAI,EAAE,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACrC,QAAQ,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,sBAAsB;oBACvC,UAAU,EAAE,EAAE,CAAC,iBAAiB;oBAChC,aAAa;iBAChB,CAAC,CAAC;YACP,CAAC;QACL,CAAC;QAED,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,MAAM,UAAU,GAAc,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,aAAa;gBAAE,MAAM,GAAG,IAAI,CAAC;YACjE,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS;gBAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;iBAC9C,IAAI,CAAC,CAAC,UAAU,KAAK,iBAAiB,IAAI,CAAC,CAAC,CAAC,aAAa;gBAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7D,MAAM,IAAI,KAAK,CACX,gEAAgE;gBAChE,gFAAgF;gBAChF,+DAA+D;gBAC/D,KAAK;gBACL,2GAA2G,CAC9G,CAAC;QACN,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC3B,KAAK,CAAC,CAAC,KAAK,eAAe,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAChE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACb,MAAM,IAAI,KAAK,CACX,iFAAiF;gBACjF,0CAA0C;gBAC1C,KAAK;gBACL,+EAA+E;gBAC/E,kFAAkF,CACrF,CAAC;QACN,CAAC;IACL,CAAC;IAEM,aAAa,CAAC,MAAkB,EAAE,IAAY,EAAE,OAA8B;QACjF,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAoB,EAAE,IAAI,EAAE,OAAiE,CAAC,CAAC;IAClH,CAAC;IAEM,KAAK,CAAC,KAAK;QACd,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACvC,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YACvC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,EAAE;gBACxD,MAAM,IAAI,GAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAU,CAAC,IAAI,CAAC;gBACrD,OAAO,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,EAAE;YACpC,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,OAAO,EAAE,IAAI,CAAC,WAAW;SAC5B,CAAC,CAAC;IACP,CAAC;IAEM,KAAK,CAAC,QAAQ;QACjB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,eAAe,CAAC;QAChC,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE;YACtC,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAChE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,WAAW,GAAG,IAAI,CAAC;YACzB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;YACjD,OAAO,IAAI,CAAC,cAAc,GAAG,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;gBAC7D,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1D,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QAC5C,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAEM,OAAO,CAAC,QAAoC;QAC/C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IAChB,CAAC;IAEM,UAAU,CAAC,QAAoC;QAClD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IAChB,CAAC"}
|
|
@@ -0,0 +1,15 @@
|
|
|
1
|
+
import { GGContextKey } from "@grest-ts/context";
|
|
2
|
+
import { GGPermissionChecker } from "@grest-ts/schema";
|
|
3
|
+
/**
|
|
4
|
+
* Per-request permission context populated by the gate when a scope resolver
|
|
5
|
+
* is wired via GGHttp.usePermissions(...). Handler code can read it to make
|
|
6
|
+
* sub-decisions inside an authorized method:
|
|
7
|
+
*
|
|
8
|
+
* const perm = GG_PERMISSIONS.get();
|
|
9
|
+
* if (perm.has(AppPermission.Admin)) { ... }
|
|
10
|
+
*
|
|
11
|
+
* The checker uses the same satisfies() the framework gate uses — no parallel
|
|
12
|
+
* implementations.
|
|
13
|
+
*/
|
|
14
|
+
export declare const GG_PERMISSIONS: GGContextKey<GGPermissionChecker>;
|
|
15
|
+
//# sourceMappingURL=GG_PERMISSIONS.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"GG_PERMISSIONS.d.ts","sourceRoot":"","sources":["../../../src/server/GG_PERMISSIONS.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,YAAY,EAAC,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAC,mBAAmB,EAAQ,MAAM,kBAAkB,CAAC;AAE5D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,cAAc,mCAAqE,CAAC"}
|
|
@@ -0,0 +1,15 @@
|
|
|
1
|
+
import { GGContextKey } from "@grest-ts/context";
|
|
2
|
+
import { IsAny } from "@grest-ts/schema";
|
|
3
|
+
/**
|
|
4
|
+
* Per-request permission context populated by the gate when a scope resolver
|
|
5
|
+
* is wired via GGHttp.usePermissions(...). Handler code can read it to make
|
|
6
|
+
* sub-decisions inside an authorized method:
|
|
7
|
+
*
|
|
8
|
+
* const perm = GG_PERMISSIONS.get();
|
|
9
|
+
* if (perm.has(AppPermission.Admin)) { ... }
|
|
10
|
+
*
|
|
11
|
+
* The checker uses the same satisfies() the framework gate uses — no parallel
|
|
12
|
+
* implementations.
|
|
13
|
+
*/
|
|
14
|
+
export const GG_PERMISSIONS = new GGContextKey("permissions", IsAny);
|
|
15
|
+
//# sourceMappingURL=GG_PERMISSIONS.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"GG_PERMISSIONS.js","sourceRoot":"","sources":["../../../src/server/GG_PERMISSIONS.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,YAAY,EAAC,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAsB,KAAK,EAAC,MAAM,kBAAkB,CAAC;AAE5D;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,YAAY,CAAsB,aAAa,EAAE,KAAY,CAAC,CAAC"}
|