@heliyos/heliyos-api-core 1.0.71 → 1.0.72

package/dist/authentication.d.ts

@@ -15,7 +15,6 @@ export interface IAuthResponseApiKey {
     policy: IAuthResponseApiKeyPolicy[] | undefined;
     userId: string;
     organizationId: string;
-    organizationIsActive?: boolean;
     organizationBillingStatus?: string;
 }
 interface IAuthResponseApiKeyPolicy {

package/dist/authentication.js

@@ -23,26 +23,11 @@ exports.authentication = void 0;
 const basic_auth_1 = __importDefault(require("basic-auth"));
 const customError_1 = require("./@types/globals/customError");
 const _1 = require(".");
-const INACTIVE_ORG_ALLOWED_PATH_PREFIXES = [
-    "/v1/platform/billing/overview",
-    "/v1/platform/billing/products",
-    "/v1/platform/billing/payments",
-    "/v1/platform/billing/portal-link",
-    "/v1/platform/billing/portal",
-    "/v1/platform/billing/customer-portal",
-    "/v1/platform/billing/callback/",
-    "/v1/auth/session/logout",
-];
 const BASIC_AUTH_ALLOWED_PATH_PREFIXES = [
+    "/v1/auth/",
     "/v1/platform/billing/internal/",
     "/v1/platform/usage/internal/log",
 ];
-const canAccessWithInactiveOrganization = (path) => {
-    if (!path) {
-        return false;
-    }
-    return INACTIVE_ORG_ALLOWED_PATH_PREFIXES.some((prefix) => path.startsWith(prefix));
-};
 const canAccessWithBasicAuth = (path) => {
     if (!path) {
         return false;
@@ -121,24 +106,6 @@ const authentication = (req, res, next) => __awaiter(void 0, void 0, void 0, fun
                 message: "Basic authentication is restricted to internal service endpoints.",
             });
         }
-        const authUser = authenticationResponse;
-        const hasOrganizationContext = Boolean(authUser === null || authUser === void 0 ? void 0 : authUser.organizationId);
-        const organizationIsActive = authUser === null || authUser === void 0 ? void 0 : authUser.organizationIsActive;
-        const shouldBlockInactiveOrganization = hasOrganizationContext &&
-            organizationIsActive !== true &&
-            !canAccessWithInactiveOrganization(req.path || req.originalUrl || "");
-        if (shouldBlockInactiveOrganization) {
-            return res.status(403).json({
-                error: {
-                    status: 403,
-                    err_msg: "FORBIDDEN",
-                },
-                message: "Organization billing is inactive. Please renew your subscription to continue.",
-                data: {
-                    organizationBillingStatus: authUser.organizationBillingStatus || "past_due",
-                },
-            });
-        }
         //	Set logged in user data which can be used later on
         setLoggedInUser(container, req);
         //	Move to next chain
@@ -318,7 +285,7 @@ const setLoggedInUser = function (container, req) {
     //
     //	Handle Cookie and Bearer token
     const { output: { loggedInUser }, } = container;
-    const { token, userId, organizationId, role, userFullName } = loggedInUser;
+    const { token, userId, organizationId, role, userFullName, organizationBillingStatus } = loggedInUser;
     //	Modify req object with logged in user data
     req.loggedInUser = {
         token,
@@ -326,6 +293,7 @@ const setLoggedInUser = function (container, req) {
         organizationId,
         role,
         userFullName,
+        organizationBillingStatus,
         auth_type,
     };
     return undefined;
@@ -351,7 +319,6 @@ const callAuthApiServer = (token) => __awaiter(void 0, void 0, void 0, function*
                 organizationId: authResult.data.data.payload.organizationId,
                 role: authResult.data.data.payload.role,
                 userFullName: authResult.data.data.payload.userFullName,
-                organizationIsActive: authResult.data.data.payload.organizationIsActive,
                 organizationBillingStatus: authResult.data.data.payload.organizationBillingStatus,
             };
         }

package/dist/authorization.d.ts

@@ -1,12 +1,20 @@
 /**
- * Authorize the user with the resource action
+ * Authorize the user with the resource action.
+ * Also enforces billing gate: write actions (ADD/EDIT/DELETE/CREATE)
+ * are blocked when the org's billingStatus is canceled or expired.
+ * Read actions (VIEW_*) always pass through.
+ *
  * @param organizationId
  * @param userId
  * @param resourceAction
+ * @param options.allowInactive - bypass inactive org check in auth service
+ * @param options.billingStatus - org billing status from session; used for write-gate
  * @returns
  */
 export declare const authorizeUser: <T = string, U = string>(organizationId: T, userId: U, resourceAction: string, options?: {
     allowInactive?: boolean;
+    billingStatus?: string;
+    userRole?: string;
 }) => Promise<{
     isAllowed: string;
     userRole: string;

package/dist/authorization.js

@@ -12,16 +12,37 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.authorizeUser = void 0;
 const customError_1 = require("./@types/globals/customError");
 const axios_1 = require("./axios");
+const BILLING_BLOCKED_STATUSES = ["canceled", "incomplete_expired"];
 /**
- * Authorize the user with the resource action
+ * Authorize the user with the resource action.
+ * Also enforces billing gate: write actions (ADD/EDIT/DELETE/CREATE)
+ * are blocked when the org's billingStatus is canceled or expired.
+ * Read actions (VIEW_*) always pass through.
+ *
  * @param organizationId
  * @param userId
  * @param resourceAction
+ * @param options.allowInactive - bypass inactive org check in auth service
+ * @param options.billingStatus - org billing status from session; used for write-gate
  * @returns
  */
 // eslint-disable-next-line import/prefer-default-export, @typescript-eslint/naming-convention
 const authorizeUser = (organizationId, userId, resourceAction, options) => __awaiter(void 0, void 0, void 0, function* () {
     try {
+        // Platform admin roles bypass billing gate entirely
+        const PLATFORM_ROLES = ["SUPER_ADMIN", "STAFF", "SUPPORT"];
+        const isPlatformAdmin = PLATFORM_ROLES.includes(String((options === null || options === void 0 ? void 0 : options.userRole) || "").toUpperCase());
+        // Billing gate: block write actions for orgs with canceled/expired billing
+        // Platform admins (SUPER_ADMIN etc.) are exempt
+        const isWriteAction = !resourceAction.startsWith("VIEW_");
+        if (!isPlatformAdmin &&
+            isWriteAction &&
+            (options === null || options === void 0 ? void 0 : options.billingStatus) &&
+            BILLING_BLOCKED_STATUSES.includes(options.billingStatus)) {
+            const error = new customError_1.HttpError("Your subscription is inactive. Please renew to continue.");
+            error.status = "403";
+            throw error;
+        }
         const authenticationResponse = yield axios_1.coreAxios.authServer.post(`/v1/auth/user/${userId}`, {
             resourceAction,
             organizationId,

package/dist/static/authPolicyFile.d.ts

@@ -5,6 +5,7 @@ interface IAuthPolicy {
 }
 export type RolesPermissionsType = {
     MEMBER?: string[];
+    AGENCY?: string[];
     TEAM_MEMBER: string[];
     ADMIN: string[];
     OWNER: string[];

package/dist/static/authPolicyFile.js

@@ -700,5 +700,9 @@ exports.authPolicy = {
         ],
     },
 };
+// MEMBER is the canonical name (renamed from TEAM_MEMBER)
 const memberRolePermissions = Array.from(new Set(exports.authPolicy.ROLES_PERMISSIONS.TEAM_MEMBER));
 exports.authPolicy.ROLES_PERMISSIONS.MEMBER = memberRolePermissions;
+// AGENCY has the same permissions as OWNER
+const agencyRolePermissions = Array.from(new Set(exports.authPolicy.ROLES_PERMISSIONS.OWNER));
+exports.authPolicy.ROLES_PERMISSIONS.AGENCY = agencyRolePermissions;

package/dist/static/authPolicyFile.ts

@@ -773,12 +773,18 @@ export const authPolicy: IAuthPolicy = {
   },
 };
 
+// MEMBER is the canonical name (renamed from TEAM_MEMBER)
 const memberRolePermissions = Array.from(
   new Set(authPolicy.ROLES_PERMISSIONS.TEAM_MEMBER)
 );
-
 authPolicy.ROLES_PERMISSIONS.MEMBER = memberRolePermissions;
 
+// AGENCY has the same permissions as OWNER
+const agencyRolePermissions = Array.from(
+  new Set(authPolicy.ROLES_PERMISSIONS.OWNER)
+);
+authPolicy.ROLES_PERMISSIONS.AGENCY = agencyRolePermissions;
+
 interface IAuthPolicy {
   RESOURCES_ACTIONS: ResourcePolicyActionsType;
   ROLES_PERMISSIONS: RolesPermissionsType;
@@ -786,6 +792,7 @@ interface IAuthPolicy {
 
 export type RolesPermissionsType = {
   MEMBER?: string[];
+  AGENCY?: string[];
   TEAM_MEMBER: string[];
   ADMIN: string[];
   OWNER: string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heliyos/heliyos-api-core",
-  "version": "1.0.71",
+  "version": "1.0.72",
   "description": "Heliyos's core api functions and middlewares. Its a private package hosted on npm.",
   "main": "./dist/index.js",
   "scripts": {