@intlayer/backend 5.6.0 → 5.7.0

package/dist/types/utils/permissions.d.ts

@@ -0,0 +1,115 @@
+import { Dictionary, Organization, Project, Tag, User } from '../export';
+import { SessionContext } from '../types/session.types';
+/**
+ * @description
+ * A named grouping of privileges (e.g. `"org_admin"`).
+ * Users are *granted* one or more Roles.
+ */
+export type Roles = 'admin' | 'org_admin' | 'org_user' | 'project_admin' | 'project_user' | 'project_reviewer';
+/**
+ * @description
+ * An atomic operation that can be performed on a resource.
+ * - **read**: view or list
+ * - **write**: create or update
+ * - **admin**: delete or change permissions
+ */
+export type Action = 'read' | 'write' | 'admin';
+/**
+ * @description
+ * A first‑class entity in your domain model that you want to protect.
+ */
+export type Resource = {
+    organization: Organization;
+    project: Project;
+    dictionary: Dictionary;
+    tag: Tag;
+    user: User;
+};
+/**
+ * @description
+ * A literal string combining a Resource and an Action, e.g. `"project:write"`.
+ * This is the *unit* checked at runtime in your middleware.
+ */
+export type Permission = `${keyof Resource}:${Action}`;
+export declare const ROLE_POLICY: {
+    readonly admin: {
+        readonly 'organization:read': () => true;
+        readonly 'organization:write': () => true;
+        readonly 'organization:admin': () => true;
+        readonly 'project:read': () => true;
+        readonly 'project:write': () => true;
+        readonly 'project:admin': () => true;
+        readonly 'dictionary:read': () => true;
+        readonly 'dictionary:write': () => true;
+        readonly 'dictionary:admin': () => true;
+        readonly 'tag:read': () => true;
+        readonly 'tag:write': () => true;
+        readonly 'tag:admin': () => true;
+        readonly 'user:read': () => true;
+        readonly 'user:write': () => true;
+        readonly 'user:admin': () => true;
+    };
+    readonly org_admin: {
+        readonly 'organization:read': () => true;
+        readonly 'organization:write': () => true;
+        readonly 'organization:admin': () => true;
+        readonly 'project:read': () => true;
+        readonly 'project:write': () => true;
+        readonly 'project:admin': () => true;
+        readonly 'dictionary:read': () => true;
+        readonly 'dictionary:write': () => true;
+        readonly 'dictionary:admin': () => true;
+        readonly 'tag:read': () => true;
+        readonly 'tag:write': () => true;
+        readonly 'tag:admin': () => true;
+        readonly 'user:write': ({ organization, targetUserIds, }: SessionContext & {
+            targetUserIds: User["id"][];
+        }) => boolean;
+    };
+    readonly org_user: {
+        readonly 'organization:read': () => true;
+        readonly 'user:read': ({ organization, targetUserIds, }: SessionContext & {
+            targetUserIds: User["id"][];
+        }) => boolean;
+    };
+    readonly project_admin: {
+        readonly 'project:read': () => true;
+        readonly 'project:write': () => true;
+        readonly 'project:admin': () => true;
+        readonly 'tag:read': () => true;
+        readonly 'tag:write': () => true;
+        readonly 'tag:admin': () => true;
+        readonly 'user:write': ({ project, targetUserIds, }: SessionContext & {
+            targetUserIds: User["id"][];
+        }) => boolean;
+    };
+    readonly project_user: {
+        readonly 'project:read': ({ user, project }: SessionContext) => boolean;
+        readonly 'dictionary:read': ({ user, project }: SessionContext) => boolean;
+        readonly 'dictionary:write': ({ user, project }: SessionContext) => boolean;
+        readonly 'tag:read': () => true;
+        readonly 'tag:write': () => true;
+        readonly 'tag:admin': ({ user, organization }: SessionContext) => boolean;
+        readonly 'user:read': ({ project, targetUserIds, }: SessionContext & {
+            targetUserIds: User["id"][];
+        }) => boolean;
+    };
+    readonly project_reviewer: {
+        readonly 'dictionary:read': ({ user, project }: SessionContext) => boolean;
+        readonly 'dictionary:write': ({ user, project }: SessionContext) => boolean;
+        readonly 'tag:read': () => true;
+    };
+};
+export declare const getSessionRoles: ({ user, organization, project, }: SessionContext) => Roles[];
+export declare const computeEffectivePermission: (roles: Roles[]) => Permission[];
+/**
+ * Intersect two permission lists
+ * @param permissionList1 - The first permission list
+ * @param permissionList2 - The second permission list
+ * @returns The intersection of the two permission lists (only permissions present in both)
+ */
+export declare const intersectPermissions: (permissions1: Permission[], permissions2: Permission[]) => Permission[];
+type PermissionResult<R extends Roles, P extends Permission> = (typeof ROLE_POLICY)[R] extends infer RolePerms ? RolePerms extends Record<string, (args: any) => any> ? P extends keyof RolePerms ? RolePerms[P] extends undefined ? never : RolePerms[P] : never : never : never;
+export declare const hasPermission: <P extends Permission>(roles: Roles[], permission: P) => PermissionResult<Roles, P>;
+export {};
+//# sourceMappingURL=permissions.d.ts.map

package/dist/types/utils/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../src/utils/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,MAAM,KAAK,GACb,OAAO,GACP,WAAW,GACX,UAAU,GACV,eAAe,GACf,cAAc,GACd,kBAAkB,CAAC;AAEvB;;;;;;GAMG;AACH,MAAM,MAAM,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAEhD;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,YAAY,EAAE,YAAY,CAAC;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,UAAU,CAAC;IACvB,GAAG,EAAE,GAAG,CAAC;IACT,IAAI,EAAE,IAAI,CAAC;CACZ,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,GAAG,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;AAQvD,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kEAoCjB,cAAc,GAAG;YAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;SAAE;;;;iEAWhD,cAAc,GAAG;YAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;SAAE;;;;;;;;;6DAgBhD,cAAc,GAAG;YAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;SAAE;;;qDAMf,cAAc;wDAGX,cAAc;yDAEb,cAAc;;;uDAKhB,cAAc;4DAMjD,cAAc,GAAG;YAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;SAAE;;;wDAMZ,cAAc;yDAEb,cAAc;;;CAK3B,CAAC;AAEhC,eAAO,MAAM,eAAe,GAAI,kCAI7B,cAAc,KAAG,KAAK,EA6DxB,CAAC;AAEF,eAAO,MAAM,0BAA0B,GAAI,OAAO,KAAK,EAAE,KAAG,UAAU,EAKnE,CAAC;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAC/B,cAAc,UAAU,EAAE,EAC1B,cAAc,UAAU,EAAE,KACzB,UAAU,EAC2D,CAAC;AAEzE,KAAK,gBAAgB,CACnB,CAAC,SAAS,KAAK,EACf,CAAC,SAAS,UAAU,IAClB,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,MAAM,SAAS,GAC/C,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,GAAG,CAAC,GAClD,CAAC,SAAS,MAAM,SAAS,GACvB,SAAS,CAAC,CAAC,CAAC,SAAS,SAAS,GAC5B,KAAK,GACL,SAAS,CAAC,CAAC,CAAC,GACd,KAAK,GACP,KAAK,GACP,KAAK,CAAC;AAEV,eAAO,MAAM,aAAa,GAAI,CAAC,SAAS,UAAU,EAChD,OAAO,KAAK,EAAE,EACd,YAAY,CAAC,KACZ,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAS3B,CAAC"}

package/dist/types/utils/rateLimiter.d.ts

@@ -0,0 +1,4 @@
+import type { NextFunction, Request, Response } from 'express';
+export declare const ipLimiter: (req: Request, res: Response, next: NextFunction) => void | Promise<void>;
+export declare const unauthenticatedChatBotLimiter: (req: Request, res: Response, next: NextFunction) => any;
+//# sourceMappingURL=rateLimiter.d.ts.map

package/dist/types/utils/rateLimiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimiter.d.ts","sourceRoot":"","sources":["../../../src/utils/rateLimiter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAS/D,eAAO,MAAM,SAAS,EAAE,CACtB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,KACf,IAAI,GAAG,OAAO,CAAC,IAAI,CAmBtB,CAAC;AAEH,eAAO,MAAM,6BAA6B,EAAE,CAC1C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,KACf,GAwBH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intlayer/backend",
-  "version": "5.6.0",
+  "version": "5.7.0",
   "private": false,
   "description": "Intlayer Backend is a an application that allow you to manage your Intlayer content and interact with the intlayer editor.",
   "keywords": [
@@ -58,14 +58,14 @@
     "@react-email/components": "^0.1.0",
     "ai": "^4.2.0",
     "bcryptjs": "^3.0.2",
+    "better-auth": "^1.3.4",
     "compression": "^1.8.0",
     "cookie-parser": "^1.4.7",
     "cors": "^2.8.5",
-    "crypto-js": "^4.2.0",
-    "csrf": "^3.1.0",
-    "csrf-csrf": "^4.0.3",
+    "deepmerge": "^4.3.1",
     "dotenv": "^16.4.7",
     "express": "^5.1.0",
+    "express-rate-limit": "^7.5.1",
     "helmet": "^8.1.0",
     "jsonwebtoken": "^9.0.2",
     "mongodb": "^6.15.0",
@@ -76,10 +76,9 @@
     "react-email": "^4.0.16",
     "resend": "^4.1.2",
     "stripe": "^18.2.1",
-    "uuid": "^11.1.0",
     "validator": "^13.12.0",
     "winston": "^3.17.0",
-    "express-intlayer": "5.6.0"
+    "express-intlayer": "5.7.0"
   },
   "devDependencies": {
     "@types/body-parser": "^1.19.5",
@@ -93,7 +92,6 @@
     "@types/node": "^22.15.30",
     "@types/oauth2-server": "^3.0.18",
     "@types/react": "^19.1.6",
-    "@types/uuid": "^10.0.0",
     "@types/validator": "^13.12.2",
     "esbuild-fix-imports-plugin": "^1.0.21",
     "eslint": "^9.28.0",
@@ -103,14 +101,15 @@
     "tsup": "^8.5.0",
     "tsx": "^4.19.4",
     "typescript": "^5.8.3",
-    "@intlayer/core": "5.6.0",
-    "@intlayer/docs": "5.6.0",
-    "@intlayer/config": "5.6.0",
-    "@utils/ts-config-types": "1.0.4",
-    "@utils/tsup-config": "1.0.4",
-    "intlayer": "5.6.0",
+    "vitest": "^3.2.2",
+    "@intlayer/core": "5.7.0",
+    "@utils/eslint-config": "1.0.4",
     "@utils/ts-config": "1.0.4",
-    "@utils/eslint-config": "1.0.4"
+    "@intlayer/docs": "5.7.0",
+    "intlayer": "5.7.0",
+    "@utils/tsup-config": "1.0.4",
+    "@utils/ts-config-types": "1.0.4",
+    "@intlayer/config": "5.7.0"
   },
   "scripts": {
     "build": "pnpm build:package & pnpm build:types",
@@ -128,6 +127,7 @@
     "start": "NODE_ENV=production node dist/esm/index.mjs",
     "start:docker": "docker run --rm -p 3100:3100 --name intlayer-backend-app intlayer-backend",
     "start:stripe": "stripe listen --forward-to localhost:3100/webhook/stripe",
-    "test": ""
+    "test": "vitest run",
+    "test:watch": "vitest"
   }
 }