@harperfast/harper 5.0.0-alpha.10

package/dist/security/certificateVerification/verificationUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verificationUtils.js","sourceRoot":"","sources":["../../../security/certificateVerification/verificationUtils.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBH,kCAWC;AAOD,0DAuBC;AAOD,oEAqDC;AAOD,sDAoFC;AAOD,0CAuDC;AAOD,kCAiBC;AAUD,wCAcC;AAOD,8CAGC;AAQD,gEAEC;AAOD,kDAcC;AAOD,gDAqCC;AASD,4DA+BC;AA1bD,6CAAyC;AACzC,6CAA+B;AAC/B,+CAAiC;AACjC,+DAAgE;AAChE,+DAAqD;AAGrD,MAAM,MAAM,GAAG,IAAA,yBAAa,EAAC,yBAAyB,CAAC,CAAC;AAExD;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,MAAc,EAAE,IAAY;IACvD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,CAAC;IAE1C,2BAA2B;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,SAAgB,uBAAuB,CAAC,eAAgC;IACvE,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,IAAI,OAAO,GAAG,eAAe,CAAC;IAE9B,OAAO,OAAO,EAAE,GAAG,EAAE,CAAC;QACrB,MAAM,KAAK,GAA0B,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAE3D,kDAAkD;QAClD,IAAI,OAAO,CAAC,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,KAAK,OAAO,IAAI,OAAO,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;YACzG,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC;QAC9C,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAElB,wBAAwB;QACxB,IAAI,OAAO,CAAC,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,KAAK,OAAO,EAAE,CAAC;YACxE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACrC,CAAC;aAAM,CAAC;YACP,MAAM;QACP,CAAC;IACF,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAgB,4BAA4B,CAAC,OAAe;IAC3D,IAAI,CAAC;QACJ,qCAAqC;QACrC,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAEnD,8DAA8D;QAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;QAE9E,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,MAAM,CAAC,KAAK,EAAE,CAAC,sDAAsD,CAAC,CAAC;YACvE,OAAO,EAAE,CAAC;QACX,CAAC;QAED,4BAA4B;QAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QAC1E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,KAAK,CAAC,qBAAqB,CAAC;YACrD,MAAM,EAAE,IAAI,CAAC,MAAM;SACnB,CAAC,CAAC;QAEH,MAAM,kBAAkB,GAAa,EAAE,CAAC;QAExC,kCAAkC;QAClC,KAAK,MAAM,SAAS,IAAI,aAAa,CAAC,kBAAkB,EAAE,CAAC;YAC1D,IAAI,SAAS,CAAC,iBAAiB,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBAC/E,yEAAyE;gBACzE,KAAK,MAAM,EAAE,IAAI,SAAS,CAAC,iBAAiB,EAAE,CAAC;oBAC9C,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;wBACnD,4BAA4B;wBAC5B,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC;wBACrB,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;4BAC7D,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBAC9B,CAAC;oBACF,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,CAAC,SAAS,kBAAkB,CAAC,MAAM,6BAA6B,kBAAkB,EAAE,CAAC,CAAC;QACpG,OAAO,kBAAkB,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,0DAA0D;QAC1D,2FAA2F;QAC3F,kGAAkG;QAClG,oGAAoG;QACpG,oGAAoG;QACpG,MAAM,CAAC,IAAI,EAAE,CAAC,8CAA8C,KAAK,EAAE,CAAC,CAAC;QACrE,OAAO,EAAE,CAAC;IACX,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,OAAe;IACpD,IAAI,CAAC;QACJ,uEAAuE;QACvE,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAEnD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,mEAAmE;QACnE,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAChC,oCAAoC;gBACpC,IAAI,CAAC;oBACJ,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;oBACnE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;wBACxB,MAAM,aAAa,GAAG,IAAI,KAAK,CAAC,qBAAqB,CAAC;4BACrD,MAAM,EAAE,IAAI,CAAC,MAAM;yBACnB,CAAC,CAAC;wBAEH,sCAAsC;wBACtC,KAAK,MAAM,SAAS,IAAI,aAAa,CAAC,kBAAkB,EAAE,CAAC;4BAC1D,IAAI,SAAS,CAAC,iBAAiB,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,CAAC;gCAC/E,yEAAyE;gCACzE,KAAK,MAAM,EAAE,IAAI,SAAS,CAAC,iBAAiB,EAAE,CAAC;oCAC9C,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;wCACnD,4BAA4B;wCAC5B,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC;wCACrB,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;4CAC7D,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wCACnB,CAAC;oCACF,CAAC;gCACF,CAAC;4BACF,CAAC;wBACF,CAAC;oBACF,CAAC;gBACF,CAAC;gBAAC,OAAO,QAAQ,EAAE,CAAC;oBACnB,MAAM,CAAC,IAAI,EAAE,CAAC,sDAAsD,QAAQ,EAAE,CAAC,CAAC;gBACjF,CAAC;YACF,CAAC;iBAAM,IAAI,GAAG,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;gBAC/C,yCAAyC;gBACzC,IAAI,CAAC;oBACJ,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;oBACnE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,YAAY,MAAM,CAAC,QAAQ,EAAE,CAAC;wBAClE,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;4BACvD,IAAI,UAAU,YAAY,MAAM,CAAC,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gCACtF,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gCACpD,MAAM,cAAc,GAAG,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gCAEtD,yDAAyD;gCACzD,IACC,YAAY,YAAY,MAAM,CAAC,gBAAgB;oCAC/C,YAAY,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,oBAAoB,EAC1D,CAAC;oCACF,mDAAmD;oCACnD,IAAI,cAAc,CAAC,OAAO,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;wCAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAC9B,GAAG,KAAK,CAAC,IAAI,CAAE,cAAc,CAAC,UAAkB,CAAC,YAA0B,CAAC,CAC5E,CAAC;wCACF,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;4CAC7D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wCACpB,CAAC;oCACF,CAAC;gCACF,CAAC;4BACF,CAAC;wBACF,CAAC;oBACF,CAAC;gBACF,CAAC;gBAAC,OAAO,SAAS,EAAE,CAAC;oBACpB,MAAM,CAAC,IAAI,EAAE,CAAC,2DAA2D,SAAS,EAAE,CAAC,CAAC;gBACvF,CAAC;YACF,CAAC;QACF,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,CAAC,SAAS,OAAO,CAAC,MAAM,gCAAgC,QAAQ,CAAC,MAAM,sBAAsB,CAAC,CAAC;QAC7G,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,iEAAiE;QACjE,2FAA2F;QAC3F,kGAAkG;QAClG,oGAAoG;QACpG,oGAAoG;QACpG,MAAM,CAAC,IAAI,EAAE,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC;QAC7D,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACtC,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,OAAe;IAC9C,IAAI,CAAC;QACJ,qCAAqC;QACrC,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAEnD,2EAA2E;QAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,mBAAmB,CAAC,CAAC;QAElF,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,EAAE,CAAC,2DAA2D,CAAC,CAAC;YAC5E,OAAO,EAAE,CAAC;QACX,CAAC;QAED,yCAAyC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,qEAAqE;QACrE,kFAAkF;QAClF,IAAI,IAAI,CAAC,MAAM,YAAY,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC5C,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBACvD,IAAI,UAAU,YAAY,MAAM,CAAC,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;oBACtF,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBACpD,MAAM,cAAc,GAAG,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAEtD,yDAAyD;oBACzD,IACC,YAAY,YAAY,MAAM,CAAC,gBAAgB;wBAC/C,YAAY,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,oBAAoB,EAC1D,CAAC;wBACF,mDAAmD;wBACnD,IAAI,cAAc,CAAC,OAAO,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;4BAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAC9B,GAAG,KAAK,CAAC,IAAI,CAAE,cAAc,CAAC,UAAkB,CAAC,YAA0B,CAAC,CAC5E,CAAC;4BACF,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gCAC7D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;4BACpB,CAAC;wBACF,CAAC;oBACF,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,CAAC,SAAS,QAAQ,CAAC,MAAM,yBAAyB,QAAQ,EAAE,CAAC,CAAC;QAC5E,OAAO,QAAQ,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,EAAE,CAAC,gCAAgC,KAAK,EAAE,CAAC,CAAC;QACxD,OAAO,EAAE,CAAC;IACX,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAgB,WAAW,CAAC,GAAW;IACtC,oCAAoC;IACpC,MAAM,MAAM,GAAG,GAAG;SAChB,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC;SACrC,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC;SACnC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAErB,oBAAoB;IACpB,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAEpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,IAAI,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,cAAc,CAC7B,OAAe,EACf,SAAiB,EACjB,MAAsB,EACtB,cAAoC;IAEpC,MAAM,SAAS,GAAG;QACjB,OAAO;QACP,SAAS;QACT,MAAM;QACN,GAAG,cAAc;KACjB,CAAC;IACF,MAAM,YAAY,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1F,OAAO,GAAG,MAAM,IAAI,YAAY,EAAE,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,iBAAyB;IAC1D,MAAM,IAAI,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1E,OAAO,OAAO,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,0BAA0B,CAAC,WAAmB,EAAE,YAAoB;IACnF,OAAO,GAAG,WAAW,IAAI,YAAY,EAAE,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,OAAe;IAClD,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAEnD,kCAAkC;QAClC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,YAAY,CAAC;QAC/D,OAAO,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC;aAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,EAAE,CAAC,oCAAoC,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,gDAAgD,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAClF,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,OAAe;IACjD,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAEnD,+DAA+D;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;QAE1E,IAAI,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC;gBACJ,0FAA0F;gBAC1F,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;gBACtE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;oBACxB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,sBAAsB,CAAC;wBAC5C,MAAM,EAAE,IAAI,CAAC,MAAM;qBACnB,CAAC,CAAC;oBAEH,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;wBACvB,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,YAAY,CAAC;wBACxD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;6BACtB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;6BAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;oBACZ,CAAC;gBACF,CAAC;YACF,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACrB,MAAM,CAAC,KAAK,EAAE,CAAC,6CAA6C,UAAU,wBAAwB,CAAC,CAAC;YACjG,CAAC;QACF,CAAC;QAED,iCAAiC;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE7G,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,EAAE,CAAC,oCAAoC,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,oCAAoC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,oEAAoE;AACpE,IAAI,qBAAqB,GAAoC,IAAI,CAAC;AAElE,SAAgB,wBAAwB;IACvC,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC5B,qBAAqB,GAAG,IAAA,oBAAK,EAAC;YAC7B,KAAK,EAAE,uBAAuB;YAC9B,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE;gBACX;oBACC,IAAI,EAAE,gBAAgB;oBACtB,YAAY,EAAE,IAAI;iBAClB;gBACD;oBACC,IAAI,EAAE,QAAQ,EAAE,+BAA+B;iBAC/C;gBACD;oBACC,IAAI,EAAE,QAAQ;iBACd;gBACD;oBACC,IAAI,EAAE,YAAY;iBAClB;gBACD;oBACC,IAAI,EAAE,WAAW;oBACjB,SAAS,EAAE,IAAI;oBACf,OAAO,EAAE,IAAI;iBACb;gBACD;oBACC,IAAI,EAAE,QAAQ,EAAE,kBAAkB;iBAClC;aACD;SACD,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,qBAAqB,CAAC;AAC9B,CAAC"}

package/dist/security/cryptoHash.d.ts

@@ -0,0 +1,2 @@
+export function encrypt(text: any): any;
+export function decrypt(text: any): any;

package/dist/security/cryptoHash.js

@@ -0,0 +1,35 @@
+'use strict';
+const crypto = require('crypto');
+const CRYPTO_ALGORITHM = 'aes-256-cbc';
+const KEY_BYTE_LENGTH = 32;
+const IV_BYTE_LENGTH = 16;
+const KEY_STRING_LENGTH = 64;
+const IV_STRING_LENGTH = 32;
+const ENCRYPTED_STRING_START = KEY_STRING_LENGTH + IV_STRING_LENGTH;
+module.exports = {
+    encrypt,
+    decrypt,
+};
+function encrypt(text) {
+    let key = crypto.randomBytes(KEY_BYTE_LENGTH);
+    let iv = crypto.randomBytes(IV_BYTE_LENGTH);
+    let cipher = crypto.createCipheriv(CRYPTO_ALGORITHM, Buffer.from(key), iv);
+    let encrypted = cipher.update(text);
+    encrypted = Buffer.concat([encrypted, cipher.final()]);
+    let keyString = key.toString('hex');
+    let ivString = iv.toString('hex');
+    let encryptedString = encrypted.toString('hex');
+    return keyString + ivString + encryptedString;
+}
+function decrypt(text) {
+    let keyString = text.substr(0, KEY_STRING_LENGTH);
+    let ivString = text.substr(KEY_STRING_LENGTH, IV_STRING_LENGTH);
+    let encrptedString = text.substr(ENCRYPTED_STRING_START, text.length);
+    let iv = Buffer.from(ivString, 'hex');
+    let encryptedText = Buffer.from(encrptedString, 'hex');
+    let decipher = crypto.createDecipheriv(CRYPTO_ALGORITHM, Buffer.from(keyString, 'hex'), iv);
+    let decrypted = decipher.update(encryptedText);
+    decrypted = Buffer.concat([decrypted, decipher.final()]);
+    return decrypted.toString();
+}
+//# sourceMappingURL=cryptoHash.js.map

package/dist/security/cryptoHash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cryptoHash.js","sourceRoot":"","sources":["../../security/cryptoHash.js"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEjC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AACvC,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,sBAAsB,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;AAEpE,MAAM,CAAC,OAAO,GAAG;IAChB,OAAO;IACP,OAAO;CACP,CAAC;AAEF,SAAS,OAAO,CAAC,IAAI;IACpB,IAAI,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;IAC9C,IAAI,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;IAE5C,IAAI,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3E,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAEvD,IAAI,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,eAAe,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,SAAS,GAAG,QAAQ,GAAG,eAAe,CAAC;AAC/C,CAAC;AAED,SAAS,OAAO,CAAC,IAAI;IACpB,IAAI,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAClD,IAAI,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;IAChE,IAAI,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAEtE,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACtC,IAAI,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5F,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/C,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,QAAQ,EAAE,CAAC;AAC7B,CAAC"}

package/dist/security/data_objects/PermissionAttributeResponseObject.d.ts

@@ -0,0 +1,11 @@
+export = PermissionAttributeResponseObject;
+declare class PermissionAttributeResponseObject {
+    /**
+     * Used to track role-based, attribute-level permission issues related to an incoming API request/operation
+     * @param attrName {String} name of the attribute with a permission restriction
+     * @param requiredPerms {Array} array of CRU perms that are required on attr for operation
+     */
+    constructor(attrName: string, requiredPerms?: any[]);
+    attribute_name: string;
+    required_permissions: any[];
+}

package/dist/security/data_objects/PermissionAttributeResponseObject.js

@@ -0,0 +1,14 @@
+'use strict';
+class PermissionAttributeResponseObject {
+    /**
+     * Used to track role-based, attribute-level permission issues related to an incoming API request/operation
+     * @param attrName {String} name of the attribute with a permission restriction
+     * @param requiredPerms {Array} array of CRU perms that are required on attr for operation
+     */
+    constructor(attrName, requiredPerms = []) {
+        this.attribute_name = attrName;
+        this.required_permissions = requiredPerms;
+    }
+}
+module.exports = PermissionAttributeResponseObject;
+//# sourceMappingURL=PermissionAttributeResponseObject.js.map

package/dist/security/data_objects/PermissionAttributeResponseObject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionAttributeResponseObject.js","sourceRoot":"","sources":["../../../security/data_objects/PermissionAttributeResponseObject.js"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,MAAM,iCAAiC;IACtC;;;;OAIG;IACH,YAAY,QAAQ,EAAE,aAAa,GAAG,EAAE;QACvC,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;QAC/B,IAAI,CAAC,oBAAoB,GAAG,aAAa,CAAC;IAC3C,CAAC;CACD;AAED,MAAM,CAAC,OAAO,GAAG,iCAAiC,CAAC"}

package/dist/security/data_objects/PermissionResponseObject.d.ts

@@ -0,0 +1,57 @@
+export = PermissionResponseObject;
+/**
+ * This object organizes permission checks into a cohesive response object that will be returned to
+ * the user in the case of a failed permissions check.
+ */
+declare class PermissionResponseObject {
+    error: string;
+    unauthorized_access: {};
+    invalid_schema_items: any[];
+    /**
+     * This method sets the passed error message to the unauthorizedAccess array and returns the perms response object
+     * to be returned to the API - i.e. operation requires SU role so response is sent back immediately with that error message
+     * @param errMsg
+     * @returns { PermissionResponseObject }
+     */
+    handleUnauthorizedItem(errMsg: any): PermissionResponseObject;
+    /**
+     * This method sets the passed error message to the invalidSchemaItems array and returns the perms response object
+     * to be returned to the API - i.e. operation on schema that user does not have access to or doesn't exist so response
+     * is sent back immediately with that error message
+     * @param errMsg
+     * @returns { PermissionResponseObject }
+     */
+    handleInvalidItem(errMsg: any): PermissionResponseObject;
+    /**
+     * This method is used to add an invalid schema item message to the invalidSchemaItems array if there is not an
+     * unauthorizedAccess value already tracked for the table - this ensures that we are not providing schema meta-data
+     * to the user that they should not have
+     * @param item - error string to add to array
+     * @param schema - schema that the item is a part of
+     * @param table - table that the item is a part of
+     */
+    addInvalidItem(item: any, schema: any, table: any): void;
+    /**
+     * This method is used to add an unauthorized table object to the unauthorizedAccess array
+     * @param schema - schema that table is under
+     * @param table - table name that user does not have correct perms on
+     * @param requiredPerms - permission/s that user does not have on the table to complete the operation
+     */
+    addUnauthorizedTable(schema: any, table: any, requiredTablePerms: any): void;
+    /**
+     * This method is used to add unauthorized table attribute objects to a new or, if already tracked, an existing table
+     * object tracked in the unauthorizedAccess array
+     * @param attrKeys - attribute names that are restricted
+     * @param schema - schema of table where attr restrictions exist
+     * @param table - table where attr restrictions exist
+     * @param restrictedAttrs - the perms restrictions for each attr
+     */
+    addUnauthorizedAttributes(attrKeys: any, schema: any, table: any, restrictedAttrs: any): void;
+    /**
+     * This method is used to evaluate whether or not there are permissions issues tracked and, if so, returns the response
+     * object and, if not, returns a null value meaning the validation step has passed
+     *
+     * @returns { null| PermissionResponseObject }
+     */
+    getPermsResponse(): null | PermissionResponseObject;
+}

package/dist/security/data_objects/PermissionResponseObject.js

@@ -0,0 +1,105 @@
+'use strict';
+const PermissionTableResponseObject = require('./PermissionTableResponseObject.js');
+const PermissionAttributeResponseObject = require('./PermissionAttributeResponseObject.js');
+const { HDB_ERROR_MSGS } = require('../../utility/errors/commonErrors.js');
+/**
+ * This object organizes permission checks into a cohesive response object that will be returned to
+ * the user in the case of a failed permissions check.
+ */
+class PermissionResponseObject {
+    constructor() {
+        this.error = HDB_ERROR_MSGS.OP_AUTH_PERMS_ERROR;
+        this.unauthorized_access = {};
+        this.invalid_schema_items = [];
+    }
+    /**
+     * This method sets the passed error message to the unauthorizedAccess array and returns the perms response object
+     * to be returned to the API - i.e. operation requires SU role so response is sent back immediately with that error message
+     * @param errMsg
+     * @returns { PermissionResponseObject }
+     */
+    handleUnauthorizedItem(errMsg) {
+        this.invalid_schema_items = [];
+        this.unauthorized_access = [errMsg];
+        return this;
+    }
+    /**
+     * This method sets the passed error message to the invalidSchemaItems array and returns the perms response object
+     * to be returned to the API - i.e. operation on schema that user does not have access to or doesn't exist so response
+     * is sent back immediately with that error message
+     * @param errMsg
+     * @returns { PermissionResponseObject }
+     */
+    handleInvalidItem(errMsg) {
+        this.invalid_schema_items = [errMsg];
+        this.unauthorized_access = [];
+        return this;
+    }
+    /**
+     * This method is used to add an invalid schema item message to the invalidSchemaItems array if there is not an
+     * unauthorizedAccess value already tracked for the table - this ensures that we are not providing schema meta-data
+     * to the user that they should not have
+     * @param item - error string to add to array
+     * @param schema - schema that the item is a part of
+     * @param table - table that the item is a part of
+     */
+    addInvalidItem(item, schema, table) {
+        if (schema && table) {
+            const schemaTable = `${schema}_${table}`;
+            if (this.unauthorized_access[schemaTable]) {
+                return;
+            }
+        }
+        this.invalid_schema_items.push(item);
+    }
+    /**
+     * This method is used to add an unauthorized table object to the unauthorizedAccess array
+     * @param schema - schema that table is under
+     * @param table - table name that user does not have correct perms on
+     * @param requiredPerms - permission/s that user does not have on the table to complete the operation
+     */
+    addUnauthorizedTable(schema, table, requiredTablePerms) {
+        const failedTable = new PermissionTableResponseObject(schema, table, requiredTablePerms);
+        const schemaTable = `${schema}_${table}`;
+        this.unauthorized_access[schemaTable] = failedTable;
+    }
+    /**
+     * This method is used to add unauthorized table attribute objects to a new or, if already tracked, an existing table
+     * object tracked in the unauthorizedAccess array
+     * @param attrKeys - attribute names that are restricted
+     * @param schema - schema of table where attr restrictions exist
+     * @param table - table where attr restrictions exist
+     * @param restrictedAttrs - the perms restrictions for each attr
+     */
+    addUnauthorizedAttributes(attrKeys, schema, table, restrictedAttrs) {
+        const unauthorizedTableAttributes = [];
+        attrKeys.forEach((attr) => {
+            const attributeObject = new PermissionAttributeResponseObject(attr, restrictedAttrs[attr]);
+            unauthorizedTableAttributes.push(attributeObject);
+        });
+        const schemaTable = `${schema}_${table}`;
+        if (this.unauthorized_access[schemaTable]) {
+            this.unauthorized_access[schemaTable].required_attribute_permissions = unauthorizedTableAttributes;
+        }
+        else {
+            const failedPermObject = new PermissionTableResponseObject(schema, table, [], unauthorizedTableAttributes);
+            this.unauthorized_access[schemaTable] = failedPermObject;
+        }
+    }
+    /**
+     * This method is used to evaluate whether or not there are permissions issues tracked and, if so, returns the response
+     * object and, if not, returns a null value meaning the validation step has passed
+     *
+     * @returns { null| PermissionResponseObject }
+     */
+    getPermsResponse() {
+        const unauthorizedAccessArr = Object.values(this.unauthorized_access);
+        if (unauthorizedAccessArr.length > 0 || this.invalid_schema_items.length > 0) {
+            this.unauthorized_access = unauthorizedAccessArr;
+            return this;
+        }
+        return null;
+    }
+}
+module.exports = PermissionResponseObject;
+//# sourceMappingURL=PermissionResponseObject.js.map

package/dist/security/data_objects/PermissionResponseObject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionResponseObject.js","sourceRoot":"","sources":["../../../security/data_objects/PermissionResponseObject.js"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,MAAM,6BAA6B,GAAG,OAAO,CAAC,oCAAoC,CAAC,CAAC;AACpF,MAAM,iCAAiC,GAAG,OAAO,CAAC,wCAAwC,CAAC,CAAC;AAC5F,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,sCAAsC,CAAC,CAAC;AAE3E;;;GAGG;AACH,MAAM,wBAAwB;IAC7B;QACC,IAAI,CAAC,KAAK,GAAG,cAAc,CAAC,mBAAmB,CAAC;QAChD,IAAI,CAAC,mBAAmB,GAAG,EAAE,CAAC;QAC9B,IAAI,CAAC,oBAAoB,GAAG,EAAE,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,sBAAsB,CAAC,MAAM;QAC5B,IAAI,CAAC,oBAAoB,GAAG,EAAE,CAAC;QAC/B,IAAI,CAAC,mBAAmB,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;;;OAMG;IACH,iBAAiB,CAAC,MAAM;QACvB,IAAI,CAAC,oBAAoB,GAAG,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,mBAAmB,GAAG,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;;;;OAOG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK;QACjC,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;YACrB,MAAM,WAAW,GAAG,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;YACzC,IAAI,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC3C,OAAO;YACR,CAAC;QACF,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED;;;;;OAKG;IACH,oBAAoB,CAAC,MAAM,EAAE,KAAK,EAAE,kBAAkB;QACrD,MAAM,WAAW,GAAG,IAAI,6BAA6B,CAAC,MAAM,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC;QAEzF,MAAM,WAAW,GAAG,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;QACzC,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC;IACrD,CAAC;IAED;;;;;;;OAOG;IACH,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe;QACjE,MAAM,2BAA2B,GAAG,EAAE,CAAC;QACvC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACzB,MAAM,eAAe,GAAG,IAAI,iCAAiC,CAAC,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3F,2BAA2B,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;QAEzC,IAAI,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,8BAA8B,GAAG,2BAA2B,CAAC;QACpG,CAAC;aAAM,CAAC;YACP,MAAM,gBAAgB,GAAG,IAAI,6BAA6B,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,2BAA2B,CAAC,CAAC;YAC3G,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,GAAG,gBAAgB,CAAC;QAC1D,CAAC;IACF,CAAC;IAED;;;;;OAKG;IACH,gBAAgB;QACf,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACtE,IAAI,qBAAqB,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9E,IAAI,CAAC,mBAAmB,GAAG,qBAAqB,CAAC;YACjD,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;CACD;AAED,MAAM,CAAC,OAAO,GAAG,wBAAwB,CAAC"}

package/dist/security/data_objects/PermissionTableResponseObject.d.ts

@@ -0,0 +1,16 @@
+export = PermissionTableResponseObject;
+declare class PermissionTableResponseObject {
+    /**
+     * Organizes permission checks into a cohesive response object that will be returned to
+     * the user in the case of a failed permissions check.
+     * @param schema {String}
+     * @param table  {String}
+     * @param requiredTablePerms {Array}
+     * @param requiredAttrPerms {Array}
+     */
+    constructor(schema: string, table: string, requiredTablePerms?: any[], requiredAttrPerms?: any[]);
+    schema: string;
+    table: string;
+    required_table_permissions: any[];
+    required_attribute_permissions: any[];
+}

package/dist/security/data_objects/PermissionTableResponseObject.js

@@ -0,0 +1,19 @@
+'use strict';
+class PermissionTableResponseObject {
+    /**
+     * Organizes permission checks into a cohesive response object that will be returned to
+     * the user in the case of a failed permissions check.
+     * @param schema {String}
+     * @param table  {String}
+     * @param requiredTablePerms {Array}
+     * @param requiredAttrPerms {Array}
+     */
+    constructor(schema, table, requiredTablePerms = [], requiredAttrPerms = []) {
+        this.schema = schema;
+        this.table = table;
+        this.required_table_permissions = requiredTablePerms;
+        this.required_attribute_permissions = requiredAttrPerms;
+    }
+}
+module.exports = PermissionTableResponseObject;
+//# sourceMappingURL=PermissionTableResponseObject.js.map

package/dist/security/data_objects/PermissionTableResponseObject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionTableResponseObject.js","sourceRoot":"","sources":["../../../security/data_objects/PermissionTableResponseObject.js"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,MAAM,6BAA6B;IAClC;;;;;;;OAOG;IACH,YAAY,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,EAAE,EAAE,iBAAiB,GAAG,EAAE;QACzE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,0BAA0B,GAAG,kBAAkB,CAAC;QACrD,IAAI,CAAC,8BAA8B,GAAG,iBAAiB,CAAC;IACzD,CAAC;CACD;AAED,MAAM,CAAC,OAAO,GAAG,6BAA6B,CAAC"}

package/dist/security/fastifyAuth.d.ts

@@ -0,0 +1,2 @@
+export function authorize(req: any, res: any, next: any): any;
+export function checkPermissions(checkPermissionObj: any, callback: any): any;

package/dist/security/fastifyAuth.js

@@ -0,0 +1,135 @@
+'use strict';
+const validation = require('../validation/check_permissions.js');
+const passport = require('passport');
+const LocalStrategy = require('passport-local').Strategy;
+const BasicStrategy = require('passport-http').BasicStrategy;
+const util = require('util');
+const userFunctions = require("./user.js");
+const cbFindValidateUsers = util.callbackify(userFunctions.findAndValidateUser);
+const hdbTerms = require("../utility/hdbTerms.js");
+const tokenAuthentication = require("./tokenAuthentication.js");
+const { AccessViolation } = require('../utility/errors/hdbError');
+passport.use(new LocalStrategy(function (username, password, done) {
+    cbFindValidateUsers(username, password, done);
+}));
+passport.use(new BasicStrategy(function (username, password, done) {
+    cbFindValidateUsers(username, password, done);
+}));
+passport.serializeUser(function (user, done) {
+    done(null, user);
+});
+passport.deserializeUser(function (user, done) {
+    done(null, user);
+});
+function authorize(req, res, next) {
+    if (req.raw?.user !== undefined)
+        return next(null, req.raw.user);
+    let strategy;
+    let token;
+    if (req.headers?.authorization) {
+        let splitAuthHeader = req.headers.authorization.split(' ');
+        strategy = splitAuthHeader[0];
+        token = splitAuthHeader[1];
+    }
+    function handleResponse(err, user) {
+        if (err) {
+            return next(err);
+        }
+        if (!user) {
+            return next(new AccessViolation());
+        }
+        return next(null, user);
+    }
+    switch (strategy) {
+        case 'Basic':
+            passport.authenticate('basic', { session: false }, (err, user) => {
+                handleResponse(err, user);
+            })(req, res, next);
+            break;
+        case 'Bearer':
+            if (req.body?.operation && req.body.operation === hdbTerms.OPERATIONS_ENUM.REFRESH_OPERATION_TOKEN) {
+                tokenAuthentication
+                    .validateRefreshToken(token)
+                    .then((user) => {
+                    req.body.refresh_token = token;
+                    next(null, user);
+                })
+                    .catch((e) => {
+                    next(e);
+                });
+            }
+            else {
+                tokenAuthentication
+                    .validateOperationToken(token)
+                    .then((user) => {
+                    next(null, user);
+                })
+                    .catch((e) => {
+                    next(e);
+                });
+            }
+            break;
+        default:
+            passport.authenticate('local', { session: false }, function (err, user) {
+                handleResponse(err, user);
+            })(req, res, next);
+            break;
+    }
+}
+function checkPermissions(checkPermissionObj, callback) {
+    let validationResults = validation(checkPermissionObj);
+    if (validationResults) {
+        callback(validationResults);
+        return;
+    }
+    let authoriziationObj = {
+        authorized: true,
+        messages: [],
+    };
+    let role = checkPermissionObj.user.role;
+    if (!role?.permission) {
+        return callback('Invalid role');
+    }
+    let permission = JSON.parse(role.permission);
+    if (permission.super_user) {
+        return callback(null, authoriziationObj);
+    }
+    if (!permission[checkPermissionObj.schema]) {
+        authoriziationObj.authorized = false;
+        authoriziationObj.messages.push(`Not authorized to access ${checkPermissionObj.schema} schema`);
+        return callback(null, authoriziationObj);
+    }
+    if (!permission[checkPermissionObj.schema].tables[checkPermissionObj.table]) {
+        authoriziationObj.authorized = false;
+        authoriziationObj.messages.push(`Not authorized to access ${checkPermissionObj.table} table`);
+        return callback(null, authoriziationObj);
+    }
+    if (!permission[checkPermissionObj.schema].tables[checkPermissionObj.table][checkPermissionObj.operation]) {
+        authoriziationObj.authorized = false;
+        authoriziationObj.messages.push(`Not authorized to access ${checkPermissionObj.operation} on ${checkPermissionObj.table} table`);
+        return callback(null, authoriziationObj);
+    }
+    if (permission[checkPermissionObj.schema].tables[checkPermissionObj.table].attribute_permissions &&
+        !checkPermissionObj.attributes) {
+        authoriziationObj.authorized = false;
+        authoriziationObj.messages.push(`${checkPermissionObj.schema}.${checkPermissionObj.table} has attribute permissions. Missing attributes to validate`);
+        return callback(null, authoriziationObj);
+    }
+    if (permission[checkPermissionObj.schema].tables[checkPermissionObj.table].attribute_permissions &&
+        checkPermissionObj.attributes) {
+        let restrictedAttrs = permission[checkPermissionObj.schema].tables[checkPermissionObj.table].attribute_permissions;
+        for (let rAttr in restrictedAttrs) {
+            if (checkPermissionObj.attributes.indexOf(restrictedAttrs[rAttr].attribute_name) > -1 &&
+                !restrictedAttrs[rAttr][checkPermissionObj.operation]) {
+                authoriziationObj.authorized = false;
+                authoriziationObj.messages.push(`Not authorized to ${checkPermissionObj.operation} ${restrictedAttrs[rAttr].attribute_name} `);
+            }
+        }
+    }
+    return callback(null, authoriziationObj);
+}
+module.exports = {
+    authorize,
+    checkPermissions,
+};
+//# sourceMappingURL=fastifyAuth.js.map

package/dist/security/fastifyAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fastifyAuth.js","sourceRoot":"","sources":["../../security/fastifyAuth.js"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,MAAM,UAAU,GAAG,OAAO,CAAC,oCAAoC,CAAC,CAAC;AACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AACrC,MAAM,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC;AACzD,MAAM,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,aAAa,CAAC;AAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAC7B,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;AAC3C,MAAM,mBAAmB,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC;AAChF,MAAM,QAAQ,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;AACnD,MAAM,mBAAmB,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAChE,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;AAElE,QAAQ,CAAC,GAAG,CACX,IAAI,aAAa,CAAC,UAAU,QAAQ,EAAE,QAAQ,EAAE,IAAI;IACnD,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC,CAAC,CACF,CAAC;AAEF,QAAQ,CAAC,GAAG,CACX,IAAI,aAAa,CAAC,UAAU,QAAQ,EAAE,QAAQ,EAAE,IAAI;IACnD,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC,CAAC,CACF,CAAC;AAEF,QAAQ,CAAC,aAAa,CAAC,UAAU,IAAI,EAAE,IAAI;IAC1C,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,CAAC,UAAU,IAAI,EAAE,IAAI;IAC5C,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI;IAChC,IAAI,GAAG,CAAC,GAAG,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,QAAQ,CAAC;IACb,IAAI,KAAK,CAAC;IACV,IAAI,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC;QAChC,IAAI,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3D,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QAC9B,KAAK,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,SAAS,cAAc,CAAC,GAAG,EAAE,IAAI;QAChC,IAAI,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,QAAQ,QAAQ,EAAE,CAAC;QAClB,KAAK,OAAO;YACX,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;gBAChE,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC3B,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACnB,MAAM;QACP,KAAK,QAAQ;YACZ,IAAI,GAAG,CAAC,IAAI,EAAE,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,eAAe,CAAC,uBAAuB,EAAE,CAAC;gBACpG,mBAAmB;qBACjB,oBAAoB,CAAC,KAAK,CAAC;qBAC3B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;oBACd,GAAG,CAAC,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;oBAC/B,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAClB,CAAC,CAAC;qBACD,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;oBACZ,IAAI,CAAC,CAAC,CAAC,CAAC;gBACT,CAAC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACP,mBAAmB;qBACjB,sBAAsB,CAAC,KAAK,CAAC;qBAC7B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;oBACd,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAClB,CAAC,CAAC;qBACD,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;oBACZ,IAAI,CAAC,CAAC,CAAC,CAAC;gBACT,CAAC,CAAC,CAAC;YACL,CAAC;YACD,MAAM;QACP;YACC,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,UAAU,GAAG,EAAE,IAAI;gBACrE,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC3B,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACnB,MAAM;IACR,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,kBAAkB,EAAE,QAAQ;IACrD,IAAI,iBAAiB,GAAG,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAEvD,IAAI,iBAAiB,EAAE,CAAC;QACvB,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QAC5B,OAAO;IACR,CAAC;IAED,IAAI,iBAAiB,GAAG;QACvB,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,EAAE;KACZ,CAAC;IAEF,IAAI,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;IAExC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC,cAAc,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAE7C,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,iBAAiB,CAAC,UAAU,GAAG,KAAK,CAAC;QACrC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,4BAA4B,kBAAkB,CAAC,MAAM,SAAS,CAAC,CAAC;QAChG,OAAO,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7E,iBAAiB,CAAC,UAAU,GAAG,KAAK,CAAC;QACrC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,4BAA4B,kBAAkB,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC9F,OAAO,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3G,iBAAiB,CAAC,UAAU,GAAG,KAAK,CAAC;QACrC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAC9B,4BAA4B,kBAAkB,CAAC,SAAS,OAAO,kBAAkB,CAAC,KAAK,QAAQ,CAC/F,CAAC;QACF,OAAO,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAC1C,CAAC;IAED,IACC,UAAU,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,qBAAqB;QAC5F,CAAC,kBAAkB,CAAC,UAAU,EAC7B,CAAC;QACF,iBAAiB,CAAC,UAAU,GAAG,KAAK,CAAC;QACrC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAC9B,GAAG,kBAAkB,CAAC,MAAM,IAAI,kBAAkB,CAAC,KAAK,4DAA4D,CACpH,CAAC;QACF,OAAO,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAC1C,CAAC;IAED,IACC,UAAU,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,qBAAqB;QAC5F,kBAAkB,CAAC,UAAU,EAC5B,CAAC;QACF,IAAI,eAAe,GAAG,UAAU,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QACnH,KAAK,IAAI,KAAK,IAAI,eAAe,EAAE,CAAC;YACnC,IACC,kBAAkB,CAAC,UAAU,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;gBACjF,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,EACpD,CAAC;gBACF,iBAAiB,CAAC,UAAU,GAAG,KAAK,CAAC;gBACrC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAC9B,qBAAqB,kBAAkB,CAAC,SAAS,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,cAAc,GAAG,CAC7F,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,OAAO,GAAG;IAChB,SAAS;IACT,gBAAgB;CAChB,CAAC"}

package/dist/security/impersonation.d.ts

@@ -0,0 +1,11 @@
+import type { User } from './user.ts';
+import type { ImpersonatePayload } from '../server/operationsServer.ts';
+/**
+ * Applies impersonation to a request. The authenticated user must be a super_user.
+ * Returns a new User object with downgraded permissions based on the impersonate payload.
+ *
+ * Mode A (inline role): `impersonate.role` is present — builds a synthetic user with the given permissions.
+ * Mode B (existing user): `impersonate.username` is present (no role/role_name) — looks up the user from cache.
+ * Mode C (existing role): `impersonate.role_name` is present (no role) — looks up the role by name and builds a synthetic user.
+ */
+export declare function applyImpersonation(authenticatedUser: User, payload: ImpersonatePayload): Promise<User>;

package/dist/security/impersonation.js

@@ -0,0 +1,139 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyImpersonation = applyImpersonation;
+const user_ts_1 = require("./user.js");
+const operationPermissions_ts_1 = require("../utility/operationPermissions.js");
+const hdbError_js_1 = require("../utility/errors/hdbError.js");
+const harper_logger_js_1 = __importDefault(require("../utility/logging/harper_logger.js"));
+const role_js_1 = require("./role.js");
+/**
+ * Applies impersonation to a request. The authenticated user must be a super_user.
+ * Returns a new User object with downgraded permissions based on the impersonate payload.
+ *
+ * Mode A (inline role): `impersonate.role` is present — builds a synthetic user with the given permissions.
+ * Mode B (existing user): `impersonate.username` is present (no role/role_name) — looks up the user from cache.
+ * Mode C (existing role): `impersonate.role_name` is present (no role) — looks up the role by name and builds a synthetic user.
+ */
+async function applyImpersonation(authenticatedUser, payload) {
+    // Gate: only super_user can impersonate
+    if (!authenticatedUser?.role?.permission?.super_user) {
+        throw new hdbError_js_1.ClientError('Only super_user can use impersonation', 403);
+    }
+    validatePayload(payload);
+    let impersonatedUser;
+    if (payload.role) {
+        // Mode A: inline permissions
+        impersonatedUser = buildInlineUser(authenticatedUser, payload);
+    }
+    else if (payload.role_name) {
+        // Mode C: look up existing role by name
+        impersonatedUser = await lookupRole(authenticatedUser, payload);
+    }
+    else {
+        // Mode B: look up existing user by username
+        impersonatedUser = await lookupUser(payload.username);
+    }
+    // Enforce downgrade: never allow escalation
+    enforceDowngrade(impersonatedUser);
+    // Tag for audit trail
+    impersonatedUser._impersonated = true;
+    impersonatedUser._impersonatedBy = authenticatedUser.username;
+    harper_logger_js_1.default.info(`Impersonation applied: "${authenticatedUser.username}" impersonating as "${impersonatedUser.username}"`);
+    return impersonatedUser;
+}
+function validatePayload(payload) {
+    if (typeof payload !== 'object' || payload === null || Array.isArray(payload)) {
+        throw new hdbError_js_1.ClientError('Invalid impersonate payload: must be an object');
+    }
+    const hasRole = payload.role !== undefined;
+    const hasUsername = typeof payload.username === 'string' && payload.username.length > 0;
+    const hasRoleName = typeof payload.role_name === 'string' && payload.role_name.length > 0;
+    if (!hasRole && !hasUsername && !hasRoleName) {
+        throw new hdbError_js_1.ClientError("Invalid impersonate payload: must include 'username', 'role_name', or 'role' with 'permission'");
+    }
+    if (hasRole) {
+        if (typeof payload.role !== 'object' || payload.role === null) {
+            throw new hdbError_js_1.ClientError("Invalid impersonate payload: 'role' must be an object");
+        }
+        if (typeof payload.role.permission !== 'object' || payload.role.permission === null) {
+            throw new hdbError_js_1.ClientError("Invalid impersonate payload: 'role.permission' must be an object");
+        }
+        validateOperationsField(payload.role.permission);
+    }
+}
+function validateOperationsField(permission) {
+    const operations = permission.operations;
+    if (operations === undefined)
+        return;
+    if (!Array.isArray(operations)) {
+        throw new hdbError_js_1.ClientError("Invalid impersonate payload: 'operations' must be an array");
+    }
+    const invalidOp = (0, operationPermissions_ts_1.validateOperations)(operations);
+    if (invalidOp !== null) {
+        throw new hdbError_js_1.ClientError(`Invalid impersonate payload: unknown operation '${invalidOp}'`);
+    }
+}
+function buildInlineUser(authenticatedUser, payload) {
+    const username = payload.username || authenticatedUser.username;
+    return {
+        username,
+        active: true,
+        role: {
+            permission: { ...payload.role.permission },
+            role: `_impersonated`,
+            id: `_impersonated_${username}`,
+            __updatedtime__: Date.now(),
+            __createdtime__: Date.now(),
+        },
+    };
+}
+async function lookupUser(username) {
+    const cache = await (0, user_ts_1.getUsersWithRolesCache)();
+    const cachedUser = cache.get(username);
+    if (!cachedUser) {
+        throw new hdbError_js_1.ClientError(`Impersonation target user '${username}' not found`, 404);
+    }
+    if (cachedUser.active === false) {
+        throw new hdbError_js_1.ClientError(`Impersonation target user '${username}' is inactive`, 403);
+    }
+    // Shallow-clone to avoid mutating cache (same pattern as auth.ts)
+    const cloned = {
+        ...cachedUser,
+        role: cachedUser.role
+            ? {
+                ...cachedUser.role,
+                permission: { ...cachedUser.role.permission },
+                id: `_impersonated_${username}`,
+            }
+            : cachedUser.role,
+    };
+    return cloned;
+}
+async function lookupRole(authenticatedUser, payload) {
+    const role = await (0, role_js_1.getRoleByName)(payload.role_name);
+    if (!role) {
+        throw new hdbError_js_1.ClientError(`Impersonation target role '${payload.role_name}' not found`, 404);
+    }
+    const username = payload.username || authenticatedUser.username;
+    return {
+        username,
+        active: true,
+        role: {
+            permission: { ...role.permission },
+            role: role.role,
+            id: `_impersonated_${username}`,
+            __updatedtime__: Date.now(),
+            __createdtime__: Date.now(),
+        },
+    };
+}
+function enforceDowngrade(user) {
+    if (!user.role?.permission)
+        return;
+    user.role.permission.super_user = false;
+    user.role.permission.cluster_user = false;
+}
+//# sourceMappingURL=impersonation.js.map

package/dist/security/impersonation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"impersonation.js","sourceRoot":"","sources":["../../security/impersonation.ts"],"names":[],"mappings":";;;;;AAgBA,gDAiCC;AA/CD,uCAAmD;AACnD,gFAAwE;AACxE,+DAA4D;AAC5D,2FAA+D;AAC/D,uCAA0C;AAE1C;;;;;;;GAOG;AACI,KAAK,UAAU,kBAAkB,CAAC,iBAAuB,EAAE,OAA2B;IAC5F,wCAAwC;IACxC,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;QACtD,MAAM,IAAI,yBAAW,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;IAED,eAAe,CAAC,OAAO,CAAC,CAAC;IAEzB,IAAI,gBAAsB,CAAC;IAE3B,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,6BAA6B;QAC7B,gBAAgB,GAAG,eAAe,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;SAAM,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9B,wCAAwC;QACxC,gBAAgB,GAAG,MAAM,UAAU,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;SAAM,CAAC;QACP,4CAA4C;QAC5C,gBAAgB,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,QAAS,CAAC,CAAC;IACxD,CAAC;IAED,4CAA4C;IAC5C,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IAEnC,sBAAsB;IACtB,gBAAgB,CAAC,aAAa,GAAG,IAAI,CAAC;IACtC,gBAAgB,CAAC,eAAe,GAAG,iBAAiB,CAAC,QAAQ,CAAC;IAE9D,0BAAY,CAAC,IAAI,CAChB,2BAA2B,iBAAiB,CAAC,QAAQ,uBAAuB,gBAAgB,CAAC,QAAQ,GAAG,CACxG,CAAC;IAEF,OAAO,gBAAgB,CAAC;AACzB,CAAC;AAED,SAAS,eAAe,CAAC,OAA2B;IACnD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,yBAAW,CAAC,gDAAgD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC;IAC3C,MAAM,WAAW,GAAG,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACxF,MAAM,WAAW,GAAG,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;IAE1F,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,IAAI,yBAAW,CACpB,gGAAgG,CAChG,CAAC;IACH,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACb,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC/D,MAAM,IAAI,yBAAW,CAAC,uDAAuD,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YACrF,MAAM,IAAI,yBAAW,CAAC,kEAAkE,CAAC,CAAC;QAC3F,CAAC;QACD,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC;AACF,CAAC;AAED,SAAS,uBAAuB,CAAC,UAAmC;IACnE,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IACzC,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO;IAErC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,yBAAW,CAAC,4DAA4D,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,SAAS,GAAG,IAAA,4CAAkB,EAAC,UAAU,CAAC,CAAC;IACjD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,yBAAW,CAAC,mDAAmD,SAAS,GAAG,CAAC,CAAC;IACxF,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CAAC,iBAAuB,EAAE,OAA2B;IAC5E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAC,QAAQ,CAAC;IAEhE,OAAO;QACN,QAAQ;QACR,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE;YACL,UAAU,EAAE,EAAE,GAAG,OAAO,CAAC,IAAK,CAAC,UAAU,EAAE;YAC3C,IAAI,EAAE,eAAe;YACrB,EAAE,EAAE,iBAAiB,QAAQ,EAAE;YAC/B,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE;YAC3B,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE;SAC3B;KACD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAgB;IACzC,MAAM,KAAK,GAAG,MAAM,IAAA,gCAAsB,GAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAEvC,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,MAAM,IAAI,yBAAW,CAAC,8BAA8B,QAAQ,aAAa,EAAE,GAAG,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACjC,MAAM,IAAI,yBAAW,CAAC,8BAA8B,QAAQ,eAAe,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC;IAED,kEAAkE;IAClE,MAAM,MAAM,GAAS;QACpB,GAAG,UAAU;QACb,IAAI,EAAE,UAAU,CAAC,IAAI;YACpB,CAAC,CAAC;gBACA,GAAG,UAAU,CAAC,IAAI;gBAClB,UAAU,EAAE,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE;gBAC7C,EAAE,EAAE,iBAAiB,QAAQ,EAAE;aAC/B;YACF,CAAC,CAAC,UAAU,CAAC,IAAI;KAClB,CAAC;IACF,OAAO,MAAM,CAAC;AACf,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,iBAAuB,EAAE,OAA2B;IAC7E,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAa,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEpD,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,yBAAW,CAAC,8BAA8B,OAAO,CAAC,SAAS,aAAa,EAAE,GAAG,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAC,QAAQ,CAAC;IAEhE,OAAO;QACN,QAAQ;QACR,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE;YACL,UAAU,EAAE,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE;YAClC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,EAAE,EAAE,iBAAiB,QAAQ,EAAE;YAC/B,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE;YAC3B,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE;SAC3B;KACD,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAU;IACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU;QAAE,OAAO;IACnC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,GAAG,KAAK,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,GAAG,KAAK,CAAC;AAC3C,CAAC"}

package/dist/security/jsLoader.d.ts

@@ -0,0 +1,9 @@
+import { ApplicationScope } from '../components/ApplicationScope.ts';
+/**
+ * This is the main entry point for loading plugin and application modules that may be executed in a
+ * separate top level scope. The scope indicates if we use a different top level scope or a standard import.
+ * @param moduleUrl
+ * @param scope
+ */
+export declare function scopedImport(filePath: string | URL, scope?: ApplicationScope): Promise<any>;
+export declare function preventFunctionConstructor(): void;