@h-ai/iam 0.1.0-alpha.61 → 0.1.0-alpha.63

package/dist/index.js

@@ -193,6 +193,7 @@ var IamConfigSchema = z.object({
 
 // messages/en-US.json
 var en_US_default = {
+  iam_batchUserIdsInvalid: "Provide at most 1000 non-empty user IDs",
   $schema: "https://inlang.com/schema/inlang-message-format",
   iam_securityStateFailed: "Unable to update authentication security state. Please try again later.",
   iam_securityBusy: "Too many authentication requests. Please try again later.",
@@ -380,6 +381,7 @@ var en_US_default = {
 
 // messages/zh-CN.json
 var zh_CN_default = {
+  iam_batchUserIdsInvalid: "\u8BF7\u63D0\u4F9B\u6700\u591A 1000 \u4E2A\u975E\u7A7A\u7528\u6237 ID",
   $schema: "https://inlang.com/schema/inlang-message-format",
   iam_securityStateFailed: "\u65E0\u6CD5\u66F4\u65B0\u8BA4\u8BC1\u5B89\u5168\u72B6\u6001\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5",
   iam_securityBusy: "\u8BA4\u8BC1\u8BF7\u6C42\u8FC7\u4E8E\u9891\u7E41\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5",
@@ -1103,6 +1105,23 @@ var DbUserRepository = class extends BaseReldbCrudRepository {
   }
 };
 
+// src/authn/apikey/iam-authn-apikey-scope.ts
+function covers(grant, permission) {
+  return grant === "*" || grant === permission || grant.endsWith(":*") && permission.startsWith(grant.slice(0, -1));
+}
+function applyApiKeyScopes(access, scopes) {
+  const permissions = /* @__PURE__ */ new Set();
+  for (const permission of access.permissions) {
+    for (const scope of scopes) {
+      if (covers(permission, scope))
+        permissions.add(scope);
+      else if (covers(scope, permission))
+        permissions.add(permission);
+    }
+  }
+  return { ...access, roles: scopes.includes("*") ? access.roles : [], permissions: [...permissions] };
+}
+
 // src/user/iam-user-utils.ts
 function toUser(storedUser) {
   return {
@@ -1219,7 +1238,7 @@ function createApiKeyStrategy(config) {
         return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
       }
       logger.info("API Key authentication succeeded", { userId: userResult.data.id, keyId: apiKey.id });
-      return ok(toUser(userResult.data));
+      return ok({ user: toUser(userResult.data), apiKey });
     }
   };
   const apiKeyFunctions = {
@@ -1663,6 +1682,8 @@ function generateToken() {
 }
 function buildSession(options, now, sessionTtl, accessToken) {
   return {
+    apiKeyId: options.apiKeyId,
+    apiKeyScopes: options.apiKeyScopes,
     userId: options.userId,
     username: options.username,
     displayName: options.displayName,
@@ -2160,6 +2181,7 @@ async function createAuthnOperations(deps) {
       apiKeyStrategy,
       sessionFunctions,
       authzFunctions,
+      userRepository,
       config
     });
     logger5.info("Authn sub-feature initialized");
@@ -2182,6 +2204,7 @@ function buildAuthnOperations(deps) {
     apiKeyStrategy,
     sessionFunctions,
     authzFunctions,
+    userRepository,
     config
   } = deps;
   const loginConfig = LoginConfigSchema.parse(config.login ?? {});
@@ -2195,20 +2218,6 @@ function buildAuthnOperations(deps) {
     }
     return null;
   }
-  async function resolveUserRoleCodes(userId) {
-    const rolesResult = await authzFunctions.getUserRoles(userId);
-    if (!rolesResult.success) {
-      return rolesResult;
-    }
-    return ok(rolesResult.data.map((role) => role.code));
-  }
-  async function resolveUserPermissionCodes(userId) {
-    const permissionsResult = await authzFunctions.getUserPermissions(userId);
-    if (!permissionsResult.success) {
-      return permissionsResult;
-    }
-    return ok(permissionsResult.data.map((p) => p.code));
-  }
   function resolveStrategy(type, strategy) {
     if (strategy) {
       return ok(strategy);
@@ -2230,26 +2239,22 @@ function buildAuthnOperations(deps) {
       iamM("iam_featureNotImplemented")
     );
   }
-  async function buildAuthResult(user) {
+  async function buildAuthResult(user, apiKey) {
     if (!user.enabled)
       return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
-    const [roleCodesResult, permCodesResult] = await Promise.all([
-      resolveUserRoleCodes(user.id),
-      resolveUserPermissionCodes(user.id)
-    ]);
-    if (!roleCodesResult.success) {
-      return roleCodesResult;
-    }
-    if (!permCodesResult.success) {
-      return permCodesResult;
-    }
+    const authorization = await authzFunctions.getUserAuthorization(user.id);
+    if (!authorization.success)
+      return authorization;
+    const access = authorization.data;
+    const effective = apiKey ? applyApiKeyScopes(access, apiKey.scopes) : access;
     const sessionResult = await sessionFunctions.create({
       userId: user.id,
       username: user.username,
       displayName: user.displayName,
       avatarUrl: user.avatarUrl,
-      roles: roleCodesResult.data,
-      permissions: permCodesResult.data
+      ...effective,
+      apiKeyId: apiKey?.id,
+      apiKeyScopes: apiKey?.scopes
     });
     if (!sessionResult.success) {
       return sessionResult;
@@ -2262,8 +2267,7 @@ function buildAuthnOperations(deps) {
     return ok({
       user,
       tokens: tokenPair,
-      roles: roleCodesResult.data,
-      permissions: permCodesResult.data,
+      ...effective,
       agreements: buildAgreementDisplay(agreementConfig, agreementConfig.showOnLogin)
     });
   }
@@ -2299,7 +2303,15 @@ function buildAuthnOperations(deps) {
       return loginWithStrategy("ldap", credentials, ldapStrategy);
     },
     async loginWithApiKey(credentials) {
-      return loginWithStrategy("apikey", credentials, apiKeyStrategy);
+      const disabled = loginDisabled("apikey");
+      if (disabled)
+        return disabled;
+      if (!apiKeyStrategy)
+        return err(HaiIamError.STRATEGY_NOT_SUPPORTED, iamM("iam_featureNotImplemented"));
+      const authenticated = await apiKeyStrategy.authenticate({ type: "apikey", ...credentials });
+      if (!authenticated.success)
+        return authenticated;
+      return buildAuthResult(authenticated.data.user, authenticated.data.apiKey);
     },
     async logout(accessToken) {
       const sessionResult = await sessionFunctions.get(accessToken);
@@ -2314,7 +2326,21 @@ function buildAuthnOperations(deps) {
       return ok(void 0);
     },
     async verifyToken(accessToken) {
-      return sessionFunctions.verifyToken(accessToken);
+      const session = await sessionFunctions.verifyToken(accessToken);
+      if (!session.success)
+        return session;
+      const [user, authorization] = await Promise.all([
+        userRepository.findById(session.data.userId),
+        authzFunctions.getUserAuthorization(session.data.userId)
+      ]);
+      if (!user.success)
+        return user;
+      if (!user.data?.enabled)
+        return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
+      if (!authorization.success)
+        return authorization;
+      const current = { ...session.data, username: user.data.username, displayName: user.data.displayName, avatarUrl: user.data.avatarUrl, ...authorization.data };
+      return ok(current.apiKeyId ? applyApiKeyScopes(current, current.apiKeyScopes ?? []) : current);
     },
     async sendOtp(identifier) {
       const disabled = loginDisabled("otp");
@@ -2666,6 +2692,7 @@ async function createDbRolePermissionRepository() {
   });
 }
 var USER_ROLE_TABLE = "hai_iam_user_roles";
+var ROLE_TABLE = "hai_iam_roles";
 var USER_ROLE_SCHEMA = {
   user_id: { type: "TEXT", notNull: true },
   role_id: { type: "TEXT", notNull: true }
@@ -2752,6 +2779,12 @@ async function createDbUserRoleRepository(roleRepository) {
     async getRoleIds(userId, tx) {
       return getRoleIdsInternal(userId, tx);
     },
+    async getRoleSummaries(userId) {
+      return reldb.sql.query(
+        `SELECT r.id, r.code FROM ${USER_ROLE_TABLE} ur JOIN ${ROLE_TABLE} r ON r.id = ur.role_id WHERE ur.user_id = ?`,
+        [userId]
+      );
+    },
     async getRoles(userId, tx) {
       const idsResult = await getRoleIdsInternal(userId, tx);
       if (!idsResult.success)
@@ -3186,6 +3219,15 @@ function createRbacManager(config) {
     async getUserPermissions(userId) {
       return getUserPermissionsInternal(userId);
     },
+    async getUserAuthorization(userId) {
+      const roles = await userRoleRepository.getRoleSummaries(userId);
+      if (!roles.success)
+        return roles;
+      const permissions = roles.data.length ? await rolePermissionRepository.getPermissionCodesForRoles(roles.data.map((role) => role.id)) : ok([]);
+      if (!permissions.success)
+        return permissions;
+      return ok({ roles: roles.data.map((role) => role.code), permissions: permissions.data });
+    },
     async getUserRoles(userId) {
       return userRoleRepository.getRoles(userId);
     },
@@ -4201,7 +4243,8 @@ async function createSessionOperations(deps) {
       maxAge: sessionConfig.maxAge,
       sliding: sessionConfig.sliding,
       singleDevice: sessionConfig.singleDevice,
-      sessionRepository
+      sessionRepository,
+      apiKeyRepository: config.login.apikey ? await createDbApiKeyRepository() : void 0
     });
     logger8.info("Session sub-feature initialized");
     return ok(functions);
@@ -4219,6 +4262,23 @@ function buildSessionFunctions(config) {
   const sliding = config.sliding ?? true;
   const singleDevice = config.singleDevice ?? false;
   const repo = config.sessionRepository;
+  async function validateApiKey(session) {
+    if (!session.apiKeyId)
+      return ok(session);
+    if (!config.apiKeyRepository)
+      return err(HaiIamError.APIKEY_INVALID, iamM("iam_apikeyInvalid"));
+    const found = await config.apiKeyRepository.findOneById(session.apiKeyId);
+    if (!found.success)
+      return found;
+    const key = found.data;
+    if (!key || key.userId !== session.userId)
+      return err(HaiIamError.APIKEY_INVALID, iamM("iam_apikeyInvalid"));
+    if (!key.enabled)
+      return err(HaiIamError.APIKEY_DISABLED, iamM("iam_apikeyDisabled"));
+    if (key.expiresAt && /* @__PURE__ */ new Date() > key.expiresAt)
+      return err(HaiIamError.APIKEY_EXPIRED, iamM("iam_apikeyExpired"));
+    return ok(applyApiKeyScopes({ ...session, apiKeyScopes: key.scopes }, key.scopes));
+  }
   return {
     async create(options) {
       try {
@@ -4269,6 +4329,9 @@ function buildSessionFunctions(config) {
         }
         return ok(null);
       }
+      const validated = await validateApiKey(session);
+      if (!validated.success)
+        return validated;
       if (sliding) {
         const now = /* @__PURE__ */ new Date();
         const updateResult = await repo.updateByAccessToken(accessToken, {
@@ -4279,7 +4342,7 @@ function buildSessionFunctions(config) {
           return updateResult;
         }
       }
-      return ok(stripInternalSessionFields(session));
+      return ok(stripInternalSessionFields(validated.data));
     },
     async verifyToken(accessToken) {
       const sessionResult = await this.get(accessToken);
@@ -4321,6 +4384,10 @@ function buildSessionFunctions(config) {
             iamM("iam_refreshTokenExpired")
           );
         }
+        const validated = await validateApiKey(oldSession);
+        if (!validated.success)
+          return validated;
+        const effectiveSession = validated.data;
         const removeOldSessionResult = await repo.removeByAccessToken(oldSession.accessToken);
         if (!removeOldSessionResult.success) {
           return removeOldSessionResult;
@@ -4330,8 +4397,10 @@ function buildSessionFunctions(config) {
           username: oldSession.username,
           displayName: oldSession.displayName,
           avatarUrl: oldSession.avatarUrl,
-          roles: oldSession.roles,
-          permissions: oldSession.permissions,
+          roles: effectiveSession.roles,
+          permissions: effectiveSession.permissions,
+          apiKeyId: effectiveSession.apiKeyId,
+          apiKeyScopes: effectiveSession.apiKeyScopes,
           source: oldSession.source,
           data: oldSession.data ? { ...oldSession.data, _tokenPair: void 0 } : void 0
         });
@@ -4827,6 +4896,29 @@ function buildRegistrationOps(ctx) {
 function buildUserQueryOps(ctx) {
   const { userRepository, sessionFunctions, authzFunctions } = ctx;
   return {
+    async getUsers(userIds, options) {
+      if (userIds.length > 1e3 || userIds.some((id) => typeof id !== "string" || !id.trim()))
+        return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_batchUserIdsInvalid"));
+      const ids = [...new Set(userIds)];
+      const found = /* @__PURE__ */ new Map();
+      for (let offset = 0; offset < ids.length; offset += 500) {
+        const batch = ids.slice(offset, offset + 500);
+        const users = await userRepository.findAll({ where: `id IN (${batch.map(() => "?").join(", ")})`, params: batch });
+        if (!users.success)
+          return users;
+        for (const user of users.data)
+          found.set(user.id, toUser(user));
+      }
+      const items = ids.flatMap((id) => found.has(id) ? [found.get(id)] : []);
+      if (options?.include?.includes("roles") && items.length) {
+        const roles = await authzFunctions.getUserRolesForMany(items.map((user) => user.id));
+        if (!roles.success)
+          return roles;
+        for (const user of items)
+          user.roles = roles.data.get(user.id) ?? [];
+      }
+      return ok(items);
+    },
     async getCurrentUser(accessToken) {
       const verifyResult = await sessionFunctions.verifyToken(accessToken);
       if (!verifyResult.success) {
@@ -4855,9 +4947,9 @@ function buildUserQueryOps(ctx) {
       const user = toUser(userResult.data);
       if (options?.include?.includes("roles")) {
         const rolesResult = await authzFunctions.getUserRoles(userId);
-        if (rolesResult.success) {
-          user.roles = rolesResult.data;
-        }
+        if (!rolesResult.success)
+          return rolesResult;
+        user.roles = rolesResult.data;
       }
       return ok(user);
     },
@@ -4874,6 +4966,10 @@ function buildUserQueryOps(ctx) {
         conditions.push("enabled = ?");
         params.push(options.enabled ? 1 : 0);
       }
+      if (options?.roleCode) {
+        conditions.push("EXISTS (SELECT 1 FROM hai_iam_user_roles ur JOIN hai_iam_roles r ON r.id = ur.role_id WHERE ur.user_id = hai_iam_users.id AND r.code = ?)");
+        params.push(options.roleCode);
+      }
       const where = conditions.length > 0 ? conditions.join(" AND ") : void 0;
       const sortColumn = options?.sortBy ? USER_SORT_COLUMNS[options.sortBy] : USER_SORT_COLUMNS.createdAt;
       const sortDirection = options?.sortBy && options.sortDirection === "asc" ? "ASC" : "DESC";
@@ -4890,11 +4986,10 @@ function buildUserQueryOps(ctx) {
       if (options?.include?.includes("roles") && items.length > 0) {
         const userIds = items.map((u) => u.id);
         const rolesMapResult = await authzFunctions.getUserRolesForMany(userIds);
-        if (rolesMapResult.success) {
-          for (const user of items) {
-            user.roles = rolesMapResult.data.get(user.id) ?? [];
-          }
-        }
+        if (!rolesMapResult.success)
+          return rolesMapResult;
+        for (const user of items)
+          user.roles = rolesMapResult.data.get(user.id) ?? [];
       }
       return ok({
         items,