@happyvertical/smrt-core 0.51.10 → 0.51.14

package/dist/vite-plugin/sveltekit-generator.js

@@ -237,20 +237,33 @@ function collectReadPermissionFields(objectDef, manifest) {
 	return result;
 }
 /**
+* The collection segment of generated operation permission slugs. Mirrors the
+* smrt-users `PermissionCatalogService` derivation: an explicit
+* `@smrt({ collection })` wins, then the manifest collection.
+*/
+function resolvePermissionCollection(objectDef) {
+	const configured = objectDef.decoratorConfig?.collection;
+	return typeof configured === "string" && configured.length > 0 ? configured : objectDef.collection;
+}
+/**
 * Emit the fail-closed authorization guard injected into generated route files
 * (#1540, 2c). Every generated CRUD/action handler calls `requireRouteAuth`,
 * which throws 401 unless the route is `public` or `locals` carries an
 * authenticated principal. Mirrors the knowledge-route `isKnowledgeAdmin`
 * precedent. Mutating verbs require auth even when reads are public.
 */
-function generateAuthGuardHelper(objectDef, manifest) {
+function generateAuthGuardHelper(objectDef, manifest, permissionObjectDef = objectDef) {
 	const publicAccess = getApiPublicAccess(objectDef.decoratorConfig?.api);
 	const readPermissionFields = collectReadPermissionFields(objectDef, manifest);
+	const permissionCollection = resolvePermissionCollection(permissionObjectDef);
 	return `
 // Fail-closed authorization (#1540): generated routes require an authenticated
 // principal on \`locals\` unless explicitly marked \`@smrt({ api: { public } })\`.
 const PUBLIC_ACCESS: boolean | 'read' = ${JSON.stringify(publicAccess)};
 const READ_PERMISSION_FIELDS: Array<[string, string]> = ${JSON.stringify(readPermissionFields)};
+// Operation permissions (#2977): mutating handlers require
+// \`<collection>.<action>\`, matching the smrt-users permission catalog slug.
+const PERMISSION_COLLECTION = ${JSON.stringify(permissionCollection)};
 
 interface PublicJsonOptions {
   permissions?: Iterable<string>;
@@ -282,6 +295,34 @@ function requireRouteAuth(locals: unknown, mutating: boolean): void {
   }
 }
 
+function hasGrantedPermission(value: unknown, permission: string): boolean {
+  if (Array.isArray(value)) return value.includes(permission);
+  if (value instanceof Set) return value.has(permission);
+  return false;
+}
+
+// Fail-closed write authorization (#2977): a mutating handler requires the
+// \`<collection>.<action>\` operation permission in the principal's session
+// permission snapshot (\`locals.permissions\` from smrt-users, or the
+// smrt-tenancy \`locals.tenantContext\`). A missing snapshot denies. Only an
+// explicit tenancy super-admin bypass skips the check; \`public: true\` routes
+// keep their unauthenticated semantics.
+function requireRoutePermission(locals: unknown, action: string): void {
+  if (PUBLIC_ACCESS === true) return;
+  const l = readJsonRecord(locals);
+  const tenantContext = readJsonRecord(l.tenantContext);
+  if (tenantContext.superAdminBypass === true) return;
+  const permission = \`\${PERMISSION_COLLECTION}.\${action}\`;
+  const granted =
+    hasGrantedPermission(l.permissions, permission) ||
+    hasGrantedPermission(l.permissionSet, permission) ||
+    hasGrantedPermission(l.smrtPermissions, permission) ||
+    hasGrantedPermission(tenantContext.permissions, permission);
+  if (!granted) {
+    throw error(403, 'Permission denied');
+  }
+}
+
 function getPublicJsonOptions(locals: unknown): PublicJsonOptions {
   const l = readJsonRecord(locals);
   const permissions = l.permissions ?? l.permissionSet ?? l.smrtPermissions;
@@ -560,8 +601,12 @@ function tenantReadOptionsScope(): { tenantId: string | null } | undefined {
 * The per-handler guard preamble: the fail-closed auth check (#1540 2c) plus, for
 * tenant-scoped objects, tenant-context establishment (#1540 facet 2).
 */
-function routeGuardPreamble(objectDef, mutating) {
+function routeGuardPreamble(objectDef, mutating, permissionAction) {
 	const lines = [`  requireRouteAuth(locals, ${mutating});`];
+	if (mutating) {
+		if (!permissionAction) throw new Error("Mutating generated routes require a permission action");
+		lines.push(`  requireRoutePermission(locals, ${JSON.stringify(permissionAction)});`);
+	}
 	if (needsRouteTenantContext(objectDef)) lines.push("  establishTenantContext(locals);");
 	return lines.join("\n");
 }
@@ -1713,7 +1758,7 @@ ${listAndCount}
 	const postHandler = hasPost ? `
 // Create new ${className.toLowerCase()}
 export const POST: RequestHandler = async ({ locals, request }) => {
-${routeGuardPreamble(objectDef, true)}
+${routeGuardPreamble(objectDef, true, "create")}
   const publicJsonOptions = getPublicJsonOptions(locals);
   const body: unknown = await request.json();
   const data = applyWritablePolicy(body);
@@ -1835,7 +1880,7 @@ ${generateNotFoundError(className)}
 	const putHandler = hasPut ? `
 // Update ${simpleClassName.toLowerCase()}
 export const PUT: RequestHandler = async ({ locals, params, request }) => {
-${routeGuardPreamble(objectDef, true)}
+${routeGuardPreamble(objectDef, true, "update")}
   const publicJsonOptions = getPublicJsonOptions(locals);
 ${generateCollectionLoad(className, { typeName: modelType.typeName })}
   const item = await collection.get(params.id);
@@ -1859,7 +1904,7 @@ ${serializers.itemSerializerName ? `
 	const deleteHandler = hasDelete ? `
 // Delete ${simpleClassName.toLowerCase()}
 export const DELETE: RequestHandler = async ({ locals, params }) => {
-${routeGuardPreamble(objectDef, true)}
+${routeGuardPreamble(objectDef, true, "delete")}
 ${generateCollectionLoad(className, { typeName: modelType.typeName })}
   const item = await collection.get(params.id);
 ${generateNotFoundError(className)}
@@ -1914,13 +1959,15 @@ function generateActionRouteTemplate(projectRoot, routeDir, routeSpecs, objectDe
 // DO NOT EDIT - changes will be overwritten
 
 ${importBlock}
-${generateAuthGuardHelper(objectDef, semanticManifest)}${needsTenantContext ? generateTenantContextHelper(principalContext, tenantScoped) : ""}
+${generateAuthGuardHelper(objectDef, semanticManifest, hostType === "collection" && firstSpec.lookupObjectDef && isCollectionManifestClass(semanticManifest, objectDef) ? firstSpec.lookupObjectDef : objectDef)}${needsTenantContext ? generateTenantContextHelper(principalContext, tenantScoped) : ""}
 ${generateTypedRouteErrorHelper()}
 ${handlers}`;
 }
 function generateActionRouteHandler(lookupClassName, actionName, actionDef, routeConfig, hostType, tenantScoped, needsTenantContext, lookupTypeName, hostTypeName) {
 	const handlerName = routeConfig.method;
-	const guardLines = [`  requireRouteAuth(locals, ${routeConfig.method !== "GET"});`];
+	const mutating = routeConfig.method !== "GET";
+	const guardLines = [`  requireRouteAuth(locals, ${mutating});`];
+	if (mutating) guardLines.push(`  requireRoutePermission(locals, ${JSON.stringify(actionName)});`);
 	if (needsTenantContext) guardLines.push("  establishTenantContext(locals);");
 	const authGuardLine = guardLines.join("\n");
 	const needsRequest = actionDef.parameters.length > 0;