@illustrisinteractive/sentinel-nest 0.0.1

package/src/generated/prisma/models.ts

@@ -0,0 +1,17 @@
+
+/* !!! This is code generated by Prisma. Do not edit directly. !!! */
+/* eslint-disable */
+// biome-ignore-all lint: generated file
+// @ts-nocheck 
+/*
+ * This is a barrel export file for all models and their related types.
+ *
+ * 🟢 You can import this file directly.
+ */
+export type * from './models/ModelHasRoles.js'
+export type * from './models/PermissionKeys.js'
+export type * from './models/RoleHasPermissions.js'
+export type * from './models/Roles.js'
+export type * from './models/SequelizeMeta.js'
+export type * from './models/Users.js'
+export type * from './commonInputTypes.js'

package/src/main.ts

@@ -0,0 +1,24 @@
+export * from './sentinel.module';
+export * from './sentinel.service';
+export * from './sentinel.guard';
+export * from './can.decorator';
+export * from './models/SecuredResource';
+export * from './models/SentinelConfig';
+
+// import { Logger } from '@nestjs/common';
+// import { NestFactory } from '@nestjs/core';
+// import { SentinelModule } from './sentinel.module';
+
+// async function bootstrap() {
+//   const app = await NestFactory.create(SentinelModule);
+//   const globalPrefix = 'api';
+//   app.setGlobalPrefix(globalPrefix);
+//   app.enableCors();
+//   const port = 8080;
+//   await app.listen(port);
+//   Logger.log(
+//     `🚀Main Backend Application is running on: http://localhost:${port}/${globalPrefix}`,
+//   );
+// }
+
+// bootstrap();

package/src/models/SecuredResource.d.ts

@@ -0,0 +1,8 @@
+export interface SecuredResource {
+    name: string;
+    actions: SecuredResourceAction[];
+}
+export interface SecuredResourceAction {
+    key: string;
+    description?: string;
+}

package/src/models/SecuredResource.ts

@@ -0,0 +1,9 @@
+export abstract class SecuredResource {
+  name: string;
+  actions: Record<string, SecuredResourceAction>;
+}
+
+export interface SecuredResourceAction {
+  description?: string;
+  source?: string;
+}

package/src/models/SentinelConfig.d.ts

@@ -0,0 +1,7 @@
+import { SecuredResource } from './SecuredResource';
+export interface SentinelConfig {
+    name: string;
+    sourceRoot: string;
+    sentinelConfigPath: string;
+    resources?: SecuredResource[];
+}

package/src/models/SentinelConfig.ts

@@ -0,0 +1,8 @@
+import { SecuredResource } from './SecuredResource';
+
+export interface SentinelConfig {
+  name: string;
+  sourceRoot: string;
+  sentinelConfigPath: string;
+  resources?: SecuredResource[];
+}

package/src/models/SentinelModel.ts

@@ -0,0 +1,39 @@
+import { PermissionKeysModel } from '../generated/prisma/models';
+export interface SentinelPermissionKey {
+  id: string;
+  resource: string;
+  action: string;
+  createdAt: string | Date;
+  updatedAt: string | Date;
+  description: string;
+}
+
+export interface SentinelModelRoleHasPermissions {
+  id: number;
+  role: number;
+  permission: string;
+  createdAt: string | Date;
+  updatedAt: string | Date;
+  PermissionKeys: SentinelPermissionKey;
+}
+
+export interface SentinelModelRole {
+  id: number;
+  name: string;
+  createdAt: string | Date;
+  updatedAt: string | Date;
+  RoleHasPermissions: SentinelModelRoleHasPermissions[];
+}
+
+export interface SentinelModelHasPermissions {
+  id: number;
+  role: number;
+  model: number;
+  createdAt: string | Date;
+  updatedAt: string | Date;
+  Roles: SentinelModelRole;
+}
+
+export interface SentinelModel {
+  permissions: PermissionKeysModel[];
+}

package/src/models/SentinelModuleOptions.ts

@@ -0,0 +1,11 @@
+import { SecuredResource } from './SecuredResource';
+
+export interface SentinelModuleOptions {
+  resources: SecuredResource[];
+  modelTable: string;
+  modelKey: string;
+  /**
+   * Defines which custom header Sentinel should look for when validating gRPC calls via the SentinelGuard
+   */
+  header: string;
+}

package/src/models/sequelize/PermissionKey.ts

@@ -0,0 +1,22 @@
+import {
+  Column,
+  DataType,
+  Model,
+  PrimaryKey,
+  Table,
+} from 'sequelize-typescript';
+
+@Table({ tableName: 'PermissionKeys' })
+export class PermissionKey extends Model {
+  @Column({ primaryKey: true, type: DataType.STRING })
+  declare id: string;
+
+  @Column({ type: DataType.STRING })
+  resource: string;
+
+  @Column({ type: DataType.STRING })
+  action: string;
+
+  @Column({ type: DataType.STRING })
+  description: string;
+}

package/src/models/tsconfig.json

@@ -0,0 +1,25 @@
+{
+  "compilerOptions": {
+    "module": "nodenext",
+    "moduleResolution": "nodenext",
+    "resolvePackageJsonExports": true,
+    "esModuleInterop": true,
+    "isolatedModules": true,
+    "declaration": true,
+    "removeComments": true,
+    "emitDecoratorMetadata": true,
+    "experimentalDecorators": true,
+    "allowSyntheticDefaultImports": true,
+    "target": "ES2023",
+    "sourceMap": true,
+    "outDir": "../../dist/models/sentinel",
+    "baseUrl": "./",
+    "incremental": true,
+    "skipLibCheck": true,
+    "strictNullChecks": true,
+    "forceConsistentCasingInFileNames": true,
+    "noImplicitAny": false,
+    "strictBindCallApply": false,
+    "noFallthroughCasesInSwitch": false
+  }
+}

package/src/prisma.service.ts

@@ -0,0 +1,13 @@
+import { Injectable } from '@nestjs/common';
+import { PrismaClient } from './generated/prisma/client';
+import { PrismaPg } from '@prisma/adapter-pg';
+
+@Injectable()
+export class PrismaService extends PrismaClient {
+  constructor() {
+    const adapter = new PrismaPg({
+      connectionString: `postgres://${process.env.SENTINEL_DB_USER}:${process.env.SENTINEL_DB_PASS}@${process.env.SENTINEL_DB_HOST}:${process.env.SENTINEL_DB_PORT}/${process.env.SENTINEL_DB_DATABASE}`,
+    });
+    super({ adapter });
+  }
+}

package/src/sentinel.guard.ts

@@ -0,0 +1,63 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  Inject,
+  Injectable,
+} from '@nestjs/common';
+import { SentinelService } from './sentinel.service';
+import { type Metadata } from '@grpc/grpc-js';
+import { type Request } from 'express';
+import { SentinelModel } from './models/SentinelModel';
+import { Reflector } from '@nestjs/core';
+import { Can, SecuredResourceAction } from './main';
+
+@Injectable()
+export class SentinelGuard implements CanActivate {
+  constructor(
+    private readonly sentinelService: SentinelService,
+    @Inject(Reflector) private reflector: Reflector,
+  ) {}
+  canActivate(context: ExecutionContext): boolean {
+    const requiredActions = this.reflector.getAllAndOverride<
+      SecuredResourceAction[]
+    >(Can, [context.getHandler(), context.getClass()]);
+
+    if (requiredActions.length == 0) return true;
+
+    let sentinelAuth = '';
+    if (context.getType() == 'rpc') {
+      const rpcContext: Metadata = context.switchToRpc().getContext();
+      sentinelAuth = rpcContext.get(
+        this.sentinelService.options.header || 'x-sentinel-key',
+      )[0] as string;
+    } else if (context.getType() == 'http') {
+      const httpContext: Request = context.switchToHttp().getRequest();
+      const header =
+        httpContext.headers[
+          this.sentinelService.options.header || 'x-sentinel-key'
+        ];
+      if (header && typeof header == 'string') {
+        sentinelAuth = header;
+      }
+    } else return false;
+
+    if (!sentinelAuth) return false;
+
+    try {
+      const payload: SentinelModel = this.sentinelService.verify(sentinelAuth);
+      if (!payload) return false;
+
+      const abilities = this.sentinelService.parseModelAbilities(payload);
+      for (const action of requiredActions) {
+        if (!action.source) {
+          return false;
+        }
+
+        if (abilities.can(Object.keys(action)[0], action.source)) return true;
+      }
+      return false;
+    } catch {
+      return false;
+    }
+  }
+}

package/src/sentinel.module-definition.ts

@@ -0,0 +1,5 @@
+import { ConfigurableModuleBuilder } from '@nestjs/common';
+import { SentinelModuleOptions } from './models/SentinelModuleOptions';
+
+export const { ConfigurableModuleClass, MODULE_OPTIONS_TOKEN } =
+  new ConfigurableModuleBuilder<SentinelModuleOptions>().build();

package/src/sentinel.module.ts

@@ -0,0 +1,27 @@
+import { Module } from '@nestjs/common';
+import { SentinelService } from './sentinel.service';
+import { ConfigModule, ConfigService } from '@nestjs/config';
+import { PrismaService } from './prisma.service';
+import { ConfigurableModuleClass } from './sentinel.module-definition';
+import { JwtModule } from '@nestjs/jwt';
+import { SentinelGuard } from './sentinel.guard';
+
+@Module({
+  imports: [
+    ConfigModule.forRoot({ isGlobal: true }),
+    JwtModule.registerAsync({
+      imports: [ConfigModule],
+      inject: [ConfigService],
+      useFactory: (configService: ConfigService) => ({
+        secret: configService.getOrThrow('SENTINEL_KEY'),
+        signOptions: {
+          expiresIn: '30m',
+        },
+      }),
+    }),
+  ],
+  controllers: [],
+  providers: [PrismaService, SentinelService, SentinelGuard],
+  exports: [PrismaService, SentinelService, SentinelGuard],
+})
+export class SentinelModule extends ConfigurableModuleClass {}

package/src/sentinel.service.ts

@@ -0,0 +1,188 @@
+import {
+  Inject,
+  Injectable,
+  Logger,
+  NotFoundException,
+  OnModuleInit,
+} from '@nestjs/common';
+import { Prisma } from './generated/prisma/client';
+import { PrismaService } from './prisma.service';
+import { MODULE_OPTIONS_TOKEN } from './sentinel.module-definition';
+import type { SentinelModuleOptions } from './models/SentinelModuleOptions';
+import { SecuredResource } from './main';
+import { PermissionKeysModel } from './generated/prisma/models';
+import {
+  AbilityBuilder,
+  createMongoAbility,
+  ExtractSubjectType,
+  InferSubjects,
+  MongoAbility,
+} from '@casl/ability';
+import { ConfigService } from '@nestjs/config';
+import { JwtService } from '@nestjs/jwt';
+import { SentinelModel } from './models/SentinelModel';
+
+@Injectable()
+export class SentinelService implements OnModuleInit {
+  resources: SecuredResource[];
+  options: SentinelModuleOptions;
+  constructor(
+    @Inject(MODULE_OPTIONS_TOKEN) private _options: SentinelModuleOptions,
+    private prisma: PrismaService,
+    private jwt: JwtService,
+    private config: ConfigService,
+  ) {
+    this.options = this._options;
+    this.resources = this.options.resources;
+  }
+
+  verify(token: string): SentinelModel {
+    return this.jwt.verify(token);
+  }
+
+  packModel(model: PermissionKeysModel[]) {
+    return this.jwt.sign({
+      permissions: model,
+    });
+  }
+
+  parseModelAbilities(model: SentinelModel): MongoAbility {
+    const { can, cannot, build } = new AbilityBuilder(createMongoAbility);
+
+    for (const resource of this.resources) {
+      for (const action of Object.keys(resource.actions)) {
+        if (
+          model.permissions.find(
+            (permissions) => permissions.action == resource.actions[action],
+          )
+        ) {
+          can(action, resource.name);
+        } else cannot(action, resource.name);
+      }
+    }
+
+    type Subjects = InferSubjects<any>;
+
+    return build({
+      detectSubjectType: (item) =>
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-return
+        item.constructor as ExtractSubjectType<Subjects>,
+    });
+  }
+
+  async buildModelAbilities(modelId: number) {
+    const rawModel = await this.getModelRoles(modelId);
+    if (!rawModel)
+      return new NotFoundException(
+        'The provided model ID did not return any Role assigned to it.',
+      );
+
+    const model: {
+      roles: string[];
+      permissions: PermissionKeysModel[];
+    } = {
+      roles: [],
+      permissions: [],
+    };
+
+    // for (const role of rawModel) {
+    //   model.roles.push(role.Roles.name || '');
+    //   role.Roles.RoleHasPermissions.forEach((permission) => {
+    //     model.permissions.push(permission);
+    //   });
+    // }
+
+    const { can, cannot, build } = new AbilityBuilder(createMongoAbility);
+
+    for (const resource of this.resources) {
+      for (const action of Object.keys(resource.actions)) {
+        if (
+          model.permissions.find(
+            (permissions) => permissions.action == resource.actions[action],
+          )
+        ) {
+          can(action, resource.name);
+        } else cannot(action, resource.name);
+      }
+    }
+
+    type Subjects = InferSubjects<any>;
+
+    return build({
+      detectSubjectType: (item) =>
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-return
+        item.constructor as ExtractSubjectType<Subjects>,
+    });
+  }
+
+  async onModuleInit() {
+    // check if Sentinel key has been generated
+    const key: string | undefined = this.config.get('SENTINEL_KEY');
+    if (!key) {
+      throw new Error(
+        'SENTINEL_KEY was not found during Sentinel runtime. Have you ran `npx sentinel init`?',
+      );
+    }
+
+    // check if actions exist in database
+    for (const resource of this.options.resources) {
+      const matchingActions = await this.prisma.permissionKeys.findMany({
+        where: {
+          resource: resource.name,
+        },
+      });
+
+      Object.keys(resource.actions).forEach((_key) => {
+        if (!matchingActions.find((mAction) => mAction.action == _key)) {
+          Logger.warn(
+            `Action "${_key}" in Secured Resource "${resource.name}" does not exist in the database. If these Actions are new, have you persisted them with "npx sentinel commit"?`,
+          );
+        }
+      });
+    }
+  }
+
+  async getRole(role: Prisma.RolesWhereUniqueInput) {
+    return this.prisma.roles.findUnique({
+      where: role,
+    });
+  }
+
+  async getModelRoles(modelId: number): Promise<PermissionKeysModel[]> {
+    try {
+      const result = await this.prisma.modelHasRoles.findMany({
+        where: {
+          model: modelId,
+        },
+        include: {
+          Roles: {
+            include: {
+              RoleHasPermissions: {
+                include: {
+                  PermissionKeys: true,
+                },
+              },
+            },
+          },
+        },
+      });
+
+      const flatResult: PermissionKeysModel[] = result.flatMap((rhp) =>
+        rhp.Roles.RoleHasPermissions.map((rhp) => rhp.PermissionKeys),
+      );
+
+      return flatResult;
+    } catch (error) {
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
+      throw new Error(error);
+    }
+  }
+
+  async getPermission(id: 'fds' | 'fdsk') {
+    return await this.prisma.permissionKeys.findFirst({
+      where: {
+        id,
+      },
+    });
+  }
+}

package/tsconfig.build.json

@@ -0,0 +1,11 @@
+{
+  "extends": "./tsconfig.json",
+  "exclude": [
+    "node_modules",
+    "src/models/",
+    "src/bin",
+    "test",
+    "dist",
+    "**/*spec.ts"
+  ]
+}

package/tsconfig.json

@@ -0,0 +1,25 @@
+{
+  "compilerOptions": {
+    "module": "nodenext",
+    "moduleResolution": "nodenext",
+    "resolvePackageJsonExports": true,
+    "esModuleInterop": true,
+    "isolatedModules": true,
+    "declaration": true,
+    "removeComments": true,
+    "emitDecoratorMetadata": true,
+    "experimentalDecorators": true,
+    "allowSyntheticDefaultImports": true,
+    "target": "ES2023",
+    "sourceMap": true,
+    "outDir": "./dist",
+    "baseUrl": "./",
+    "incremental": true,
+    "skipLibCheck": true,
+    "strictNullChecks": true,
+    "forceConsistentCasingInFileNames": true,
+    "noImplicitAny": false,
+    "strictBindCallApply": false,
+    "noFallthroughCasesInSwitch": false
+  }
+}