@lark-apaas/nestjs-authzpaas 0.1.0-alpha.1 → 0.1.0-alpha.11

package/dist/index.js

@@ -3,7 +3,7 @@ var __name = (target, value) => __defProp(target, "name", { value, configurable:
 
 // src/authzpaas.module.ts
 import { Module as Module2 } from "@nestjs/common";
-import { APP_FILTER, APP_GUARD as APP_GUARD2, Reflector as Reflector4 } from "@nestjs/core";
+import { APP_GUARD as APP_GUARD2, Reflector as Reflector4 } from "@nestjs/core";
 
 // src/services/permission.service.ts
 import { Injectable as Injectable3, Logger, HttpStatus, Inject } from "@nestjs/common";
@@ -120,15 +120,8 @@ var Public = /* @__PURE__ */ __name2(() => SetMetadata(IS_PUBLIC_KEY, true), "Pu
 // src/const.ts
 var ANONYMOUS_USER_ID = "anonymous_user_id";
 var PERMISSION_API_CONFIG_TOKEN = Symbol("PERMISSION_API_CONFIG");
-var CACHE_CONFIG_TOKEN = Symbol("CACHE_CONFIG");
 var AUTHZPAAS_MODULE_OPTIONS = Symbol("AUTHZPAAS_MODULE_OPTIONS");
 var ROLES_KEY = "authzpaas:roles";
-var PERMISSIONS_KEY = "authzpaas:permissions";
-var ENVIRONMENT_KEY = "authzpaas:environment";
-var NEED_LOGIN_KEY2 = "authzpaas:needLogin";
-var DEFAULT_LOGIN_PATH = "/login";
-var MOCK_ROLES_COOKIE_KEY = "mockRoles";
-var ENABLE_MOCK_ROLE_KEY = "__authzpaas_enableMockRole";
 
 // src/casl/ability.factory.ts
 import { Injectable as Injectable2 } from "@nestjs/common";
@@ -300,16 +293,13 @@ var PermissionService = class _PermissionService {
   */
   async fetchFromApi(requestDto) {
     const { timeout = 5e3 } = this.apiConfig || {};
-    const { baseUrl, userId, appId, cookies, csrfToken } = requestDto;
-    const url = `${baseUrl}/api/apps/${appId}/management/permissions/roles`;
+    const { baseUrl, userId, appId, cookie, csrfToken } = requestDto;
+    const url = `${baseUrl}/spark/app/${appId}/runtime/api/v1/permissions/roles`;
     const requestHeaders = {
       "Content-Type": "application/json"
     };
-    if (cookies) {
-      const cookieString = Object.entries(cookies).map(([key, value]) => `${key}=${value}`).join("; ");
-      if (cookieString) {
-        requestHeaders.Cookie = cookieString;
-      }
+    if (cookie) {
+      requestHeaders.Cookie = cookie;
     }
     if (csrfToken) {
       requestHeaders["X-Suda-Csrf-Token"] = csrfToken;
@@ -318,7 +308,8 @@ var PermissionService = class _PermissionService {
     const timeoutId = setTimeout(() => controller.abort(), timeout);
     try {
       const response = await fetch(url, {
-        method: "GET",
+        method: "POST",
+        credentials: "include",
         headers: requestHeaders,
         signal: controller.signal
       });
@@ -334,12 +325,13 @@ var PermissionService = class _PermissionService {
       const data = await response.json();
       return {
         userId,
-        roles: data.role_list || [],
+        roles: data.data?.roleList || [],
         // TODO: 基于权限点位设置能力
         // permissions: data.permissions || [],
         fetchedAt: /* @__PURE__ */ new Date()
       };
     } catch (error) {
+      console.log("error", error);
       clearTimeout(timeoutId);
       let err = error;
       if (error.name === "AbortError") {
@@ -382,14 +374,22 @@ var PermissionService = class _PermissionService {
   * @returns 用户权限数据
   * @throws PermissionDeniedException 当角色不满足时
   */
-  async checkRoles(requirement, userContext) {
+  async checkRoles(requirement, userContext, cookie, csrfToken) {
     const userId = userContext?.userId || ANONYMOUS_USER_ID;
+    if (!csrfToken) {
+      throw new PermissionDeniedException({
+        cause: new Error("CSRF token is required"),
+        type: PermissionDeniedType.PERMISSION_CONFIG_QUERY_FAILED,
+        message: "CSRF token is required"
+      }, HttpStatus.BAD_REQUEST);
+    }
     const permissionData = await this.getUserPermissions({
+      // FIXME: 使用 request 的 base url
       baseUrl: userContext?.baseUrl || "",
       userId,
       appId: userContext?.appId || "",
-      cookies: userContext?.cookies || {},
-      csrfToken: userContext?.csrfToken || ""
+      csrfToken,
+      cookie
     });
     if (!permissionData) {
       throw new PermissionDeniedException({
@@ -448,22 +448,20 @@ var AuthZPaasGuard = class {
   async canActivate(context) {
     const http = context.switchToHttp();
     const request = http.getRequest();
+    const cookie = request.headers.cookie;
+    const csrfToken = request.csrfToken;
+    const baseUrl = `${request.protocol}://${request.get("host")}`;
     const userContext = request.userContext;
+    userContext.baseUrl = baseUrl;
     const checkRoleRequirement = this.reflector.getAllAndOverride(ROLES_KEY, [
       context.getHandler(),
       context.getClass()
     ]);
     if (checkRoleRequirement) {
-      await this.checkRoleRequirement(checkRoleRequirement, userContext);
+      await this.permissionService.checkRoles(checkRoleRequirement, userContext, cookie, csrfToken);
     }
     return true;
   }
-  /**
-  * 检查角色要求
-  */
-  async checkRoleRequirement(requirement, userContext) {
-    return this.permissionService.checkRoles(requirement, userContext);
-  }
 };
 AuthZPaasGuard = _ts_decorate5([
   Injectable4(),
@@ -474,8 +472,7 @@ AuthZPaasGuard = _ts_decorate5([
   ])
 ], AuthZPaasGuard);
 
-// src/middlewares/roles.middleware.ts
-import { Injectable as Injectable5, Logger as Logger2 } from "@nestjs/common";
+// src/authzpaas.module.ts
 function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -483,114 +480,12 @@ function _ts_decorate6(decorators, target, key, desc) {
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
 __name(_ts_decorate6, "_ts_decorate");
-function _ts_metadata4(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata4, "_ts_metadata");
-var RolesMiddleware = class _RolesMiddleware {
-  static {
-    __name(this, "RolesMiddleware");
-  }
-  permissionService;
-  logger = new Logger2(_RolesMiddleware.name);
-  constructor(permissionService) {
-    this.permissionService = permissionService;
-  }
-  async use(req, _res, next) {
-    try {
-      const baseUrl = `${req.protocol}://${req.get("host")}`;
-      const userId = req.userContext?.userId ?? "";
-      const appId = req.userContext?.appId ?? "";
-      const cookies = req.cookies ?? {};
-      const csrfToken = req.headers["x-suda-csrf-token"] ?? "";
-      this.logger.debug(`Fetching roles for user: ${userId}`);
-      const permissionData = await this.permissionService.getUserPermissions({
-        baseUrl,
-        userId,
-        appId,
-        cookies,
-        csrfToken
-      });
-      let roles;
-      if (permissionData) {
-        roles = permissionData.roles;
-      }
-      req.userContext.baseUrl = baseUrl;
-      req.userContext.userRoles = roles;
-      req.userContext.userId = userId;
-      req.userContext.cookies = cookies;
-      req.userContext.csrfToken = csrfToken;
-      this.logger.debug(`User ${userId} roles loaded: [${roles?.join(", ")}]`);
-      next();
-    } catch (error) {
-      this.logger.warn(`Failed to fetch roles for request: ${error instanceof Error ? error.message : "Unknown error"}`);
-      next();
-    }
-  }
-};
-RolesMiddleware = _ts_decorate6([
-  Injectable5(),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
-    typeof PermissionService === "undefined" ? Object : PermissionService
-  ])
-], RolesMiddleware);
-
-// src/filters/authzpaas-exception.filter.ts
-import { Catch } from "@nestjs/common";
-function _ts_decorate7(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate7, "_ts_decorate");
-var AuthZPaasExceptionFilter = class {
-  static {
-    __name(this, "AuthZPaasExceptionFilter");
-  }
-  catch(exception, host) {
-    const ctx = host.switchToHttp();
-    const response = ctx.getResponse();
-    const status = exception.getStatus();
-    const exceptionResponse = exception.getResponse();
-    const errorResponse = {
-      statusCode: status,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      cause: exception.cause,
-      type: exception.type,
-      message: typeof exceptionResponse === "string" ? exceptionResponse : exceptionResponse.message || "\u6743\u9650\u4E0D\u8DB3"
-    };
-    if (exception.details.requiredRoles) {
-      errorResponse.requiredRoles = exception.details.requiredRoles;
-    }
-    if (exception.details.requiredPermissions) {
-      errorResponse.requiredPermissions = exception.details.requiredPermissions;
-    }
-    if (exception.details.metadata) {
-      errorResponse.metadata = exception.details.metadata;
-    }
-    response.status(status).json(errorResponse);
-  }
-};
-AuthZPaasExceptionFilter = _ts_decorate7([
-  Catch(PermissionDeniedException)
-], AuthZPaasExceptionFilter);
-
-// src/authzpaas.module.ts
-function _ts_decorate8(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate8, "_ts_decorate");
 var AuthZPaasModule = class _AuthZPaasModule {
   static {
     __name(this, "AuthZPaasModule");
   }
   static forRoot(options) {
-    const { permissionApi } = options;
+    const { permissionApi = {} } = options || {};
     return {
       module: _AuthZPaasModule,
       global: true,
@@ -613,21 +508,15 @@ var AuthZPaasModule = class _AuthZPaasModule {
         PermissionService,
         AbilityFactory,
         AuthZPaasGuard,
-        RolesMiddleware,
         // 守卫提供者
         {
           provide: APP_GUARD2,
           useClass: AuthZPaasGuard
-        },
-        {
-          provide: APP_FILTER,
-          useClass: AuthZPaasExceptionFilter
         }
       ],
       exports: [
         PermissionService,
-        AbilityFactory,
-        RolesMiddleware
+        AbilityFactory
       ]
     };
   }
@@ -691,26 +580,20 @@ var AuthZPaasModule = class _AuthZPaasModule {
         PermissionService,
         AbilityFactory,
         AuthZPaasGuard,
-        RolesMiddleware,
         // 守卫提供者
         {
           provide: APP_GUARD2,
           useClass: AuthZPaasGuard
-        },
-        {
-          provide: APP_FILTER,
-          useClass: AuthZPaasExceptionFilter
         }
       ],
       exports: [
         PermissionService,
-        AbilityFactory,
-        RolesMiddleware
+        AbilityFactory
       ]
     };
   }
 };
-AuthZPaasModule = _ts_decorate8([
+AuthZPaasModule = _ts_decorate6([
   Module2({})
 ], AuthZPaasModule);
 
@@ -739,23 +622,14 @@ export {
   ANONYMOUS_USER_ID,
   AUTHZPAAS_MODULE_OPTIONS,
   AbilityFactory,
-  AuthZPaasExceptionFilter,
   AuthZPaasGuard,
   AuthZPaasModule,
-  CACHE_CONFIG_TOKEN,
   CanRole,
-  DEFAULT_LOGIN_PATH,
-  ENABLE_MOCK_ROLE_KEY,
-  ENVIRONMENT_KEY,
-  MOCK_ROLES_COOKIE_KEY,
-  NEED_LOGIN_KEY2 as NEED_LOGIN_KEY,
-  PERMISSIONS_KEY,
   PERMISSION_API_CONFIG_TOKEN,
   PermissionDeniedException,
   PermissionDeniedType,
   PermissionService,
   ROLES_KEY,
-  ROLE_SUBJECT,
-  RolesMiddleware
+  ROLE_SUBJECT
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/authzpaas.module.ts","../src/services/permission.service.ts","../../nestjs-authnpaas/src/authnpaas.module.ts","../../nestjs-authnpaas/src/const.ts","../../nestjs-authnpaas/src/guards/authnpaas.guard.ts","../../nestjs-authnpaas/src/decorators/public.decorator.ts","../../nestjs-authnpaas/src/decorators/need-login.decorator.ts","../src/const.ts","../src/casl/ability.factory.ts","../src/exceptions/permission-denied.exception.ts","../src/guards/authzpaas.guard.ts","../src/middlewares/roles.middleware.ts","../src/filters/authzpaas-exception.filter.ts","../src/decorators/can-role.decorator.ts"],"sourcesContent":["import { DynamicModule, Module, Type } from '@nestjs/common';\nimport { APP_FILTER, APP_GUARD, Reflector } from '@nestjs/core';\n\nimport { PermissionService } from './services/permission.service';\nimport { AbilityFactory } from './casl/ability.factory';\nimport { AuthZPaasGuard } from './guards/authzpaas.guard';\nimport { RolesMiddleware } from './middlewares/roles.middleware';\nimport { AuthZPaasExceptionFilter } from './filters/authzpaas-exception.filter';\nimport { AuthZPaasModuleOptions } from './types';\nimport { AUTHZPAAS_MODULE_OPTIONS, PERMISSION_API_CONFIG_TOKEN } from './const';\n\nexport interface AuthZPaasModuleAsyncOptions {\n  imports?: Type<unknown>[];\n  inject?: (string | symbol | Type<unknown>)[];\n  useFactory: (\n    ...args: unknown[]\n  ) => Promise<AuthZPaasModuleOptions> | AuthZPaasModuleOptions;\n}\n\n@Module({})\nexport class AuthZPaasModule {\n  static forRoot(options: AuthZPaasModuleOptions): DynamicModule {\n    const { permissionApi } = options;\n    return {\n      module: AuthZPaasModule,\n      global: true,\n      controllers: [],\n      providers: [\n        // 配置提供者\n        {\n          provide: AUTHZPAAS_MODULE_OPTIONS,\n          useValue: { ...options },\n        },\n        {\n          provide: PERMISSION_API_CONFIG_TOKEN,\n          useValue: permissionApi,\n        },\n        // 核心服务\n        Reflector,\n        // 服务提供者\n        PermissionService,\n        AbilityFactory,\n        AuthZPaasGuard,\n        RolesMiddleware,\n        // 守卫提供者\n        {\n          provide: APP_GUARD,\n          useClass: AuthZPaasGuard,\n        },\n        {\n          provide: APP_FILTER,\n          useClass: AuthZPaasExceptionFilter,\n        },\n      ],\n      exports: [PermissionService, AbilityFactory, RolesMiddleware],\n    };\n  }\n\n  /**\n   * 异步注册 AuthZPaas 模块（根模块）\n   * 用于需要从配置服务获取设置的场景\n   *\n   * @param options 异步配置选项\n   * @returns 动态模块\n   *\n   * @example\n   * ```typescript\n   * @Module({\n   *   imports: [\n   *     AuthZPaasModule.forRootAsync({\n   *       imports: [ConfigModule],\n   *       inject: [ConfigService],\n   *       useFactory: async (configService: ConfigService) => ({\n   *         permissionApi: {\n   *           baseUrl: configService.get('PERMISSION_API_URL'),\n   *           apiToken: configService.get('PERMISSION_API_TOKEN'),\n   *         },\n   *         cache: {\n   *           ttl: configService.get('CACHE_TTL', 300),\n   *           max: configService.get('CACHE_MAX', 1000),\n   *         },\n   *       }),\n   *     }),\n   *   ],\n   * })\n   * export class AppModule {}\n   * ```\n   */\n  static forRootAsync(options: AuthZPaasModuleAsyncOptions): DynamicModule {\n    const { imports = [], inject = [], useFactory } = options;\n\n    return {\n      module: AuthZPaasModule,\n      global: true,\n      imports,\n      controllers: [],\n      providers: [\n        // 异步配置提供者\n        {\n          provide: AUTHZPAAS_MODULE_OPTIONS,\n          useFactory,\n          inject,\n        },\n        // 权限 API 配置提供者\n        {\n          provide: PERMISSION_API_CONFIG_TOKEN,\n          useFactory: (moduleOptions: AuthZPaasModuleOptions) => {\n            return moduleOptions.permissionApi;\n          },\n          inject: [AUTHZPAAS_MODULE_OPTIONS],\n        },\n        // 核心服务\n        Reflector,\n        // 服务提供者\n        PermissionService,\n        AbilityFactory,\n        AuthZPaasGuard,\n        RolesMiddleware,\n        // 守卫提供者\n        {\n          provide: APP_GUARD,\n          useClass: AuthZPaasGuard,\n        },\n        {\n          provide: APP_FILTER,\n          useClass: AuthZPaasExceptionFilter,\n        },\n      ],\n      exports: [PermissionService, AbilityFactory, RolesMiddleware],\n    };\n  }\n}\n","import { Injectable, Logger, HttpStatus, Inject } from '@nestjs/common';\nimport { Public } from '@lark-apaas/nestjs-authnpaas';\n\nimport type {\n  UserPermissionData,\n  UserRolesDTO,\n  UserContext,\n  PermissionApiConfig,\n} from '../types';\nimport { ANONYMOUS_USER_ID, PERMISSION_API_CONFIG_TOKEN } from '../const';\nimport { AbilityFactory, ROLE_SUBJECT } from '../casl/ability.factory';\nimport {\n  PermissionDeniedException,\n  PermissionDeniedType,\n} from '../exceptions/permission-denied.exception';\nimport type { RoleRequirement } from '../decorators';\n\n/**\n * 权限服务\n * 内置权限获取和缓存逻辑，以及权限检查逻辑\n */\n@Injectable()\n@Public() // 跳过 Guard 的鉴权检查，避免循环调用\nexport class PermissionService {\n  private readonly logger = new Logger(PermissionService.name);\n\n  constructor(\n    @Inject(PERMISSION_API_CONFIG_TOKEN)\n    private readonly apiConfig: PermissionApiConfig,\n    private readonly abilityFactory: AbilityFactory\n  ) {}\n\n  /**\n   * 获取用户权限数据\n   */\n  async getUserPermissions(\n    requestDto: UserRolesDTO\n  ): Promise<UserPermissionData | null> {\n    // 创建新的请求 Promise\n    const requestPromise = (async () => {\n      const userId = requestDto.userId || ANONYMOUS_USER_ID;\n      try {\n        const permissionData = await this.fetchFromApi(requestDto);\n        // 添加获取时间\n        const dataWithTimestamp: UserPermissionData = {\n          ...permissionData,\n          fetchedAt: new Date(),\n        };\n\n        return dataWithTimestamp;\n      } catch (error) {\n        this.logger.error(\n          `Failed to fetch permissions for user ${userId}:`,\n          error\n        );\n        throw error;\n      }\n    })();\n\n    return requestPromise;\n  }\n\n  /**\n   * 从 API 获取权限数据\n   * 内置实现，用户无需配置\n   */\n  private async fetchFromApi(\n    requestDto: UserRolesDTO\n  ): Promise<UserPermissionData> {\n    const { timeout = 5000 } = this.apiConfig || {};\n    const { baseUrl, userId, appId, cookies, csrfToken } = requestDto;\n\n    // 构建完整获取用户权限 URL\n    const url = `${baseUrl}/api/apps/${appId}/management/permissions/roles`;\n\n    // 构建请求头\n    const requestHeaders: Record<string, string> = {\n      'Content-Type': 'application/json',\n    };\n\n    if (cookies) {\n      const cookieString = Object.entries(cookies)\n        .map(([key, value]) => `${key}=${value}`)\n        .join('; ');\n      if (cookieString) {\n        requestHeaders.Cookie = cookieString;\n      }\n    }\n\n    if (csrfToken) {\n      requestHeaders['X-Suda-Csrf-Token'] = csrfToken;\n    }\n\n    // 发起请求（带超时控制）\n    const controller = new AbortController();\n    const timeoutId = setTimeout(() => controller.abort(), timeout);\n\n    try {\n      const response = await fetch(url, {\n        method: 'GET',\n        headers: requestHeaders,\n        signal: controller.signal,\n      });\n\n      clearTimeout(timeoutId);\n\n      if (!response.ok) {\n        const error = new Error(\n          `Permission API returned ${response.status}: ${response.statusText}`\n        );\n        throw new PermissionDeniedException(\n          {\n            cause: error,\n            type: PermissionDeniedType.PERMISSION_CONFIG_QUERY_FAILED,\n            message: error.message,\n          },\n          HttpStatus.INTERNAL_SERVER_ERROR\n        );\n      }\n\n      const data = (await response.json()) as {\n        role_list?: string[];\n      };\n\n      return {\n        userId,\n        roles: data.role_list || [],\n        // TODO: 基于权限点位设置能力\n        // permissions: data.permissions || [],\n        fetchedAt: new Date(),\n      };\n    } catch (error: unknown) {\n      clearTimeout(timeoutId);\n      let err = error as Error;\n\n      if ((error as { name?: string }).name === 'AbortError') {\n        err = new Error(`Permission API request timeout after ${timeout}ms`);\n      }\n\n      throw new PermissionDeniedException(\n        {\n          cause: err,\n          type: PermissionDeniedType.PERMISSION_CONFIG_QUERY_FAILED,\n          message: err.message,\n        },\n        HttpStatus.INTERNAL_SERVER_ERROR\n      );\n    }\n  }\n\n  // /**\n  //  * 获取用户的 Ability 实例（带缓存）\n  //  * @param userId 用户ID\n  //  * @returns CASL Ability 实例\n  //  */\n  // private async getUserAbility(\n  //   userId?: string,\n  //   mockRoles?: string[]\n  // ): Promise<AppAbility> {\n  //   // 计算缓存 key\n  //   const key = this.buildCacheKey(userId, mockRoles);\n\n  //   // 尝试从缓存获取\n  //   const cached = this.cache.get(key);\n  //   if (cached) {\n  //     return cached.ability;\n  //   }\n\n  //   // 缓存未命中，调用 getUserPermissions 会创建并缓存\n  //   await this.getUserPermissions(userId, mockRoles);\n\n  //   // 再次从缓存获取（此时一定存在）\n  //   const newCached = this.cache.get(key);\n  //   return newCached!.ability;\n  // }\n\n  /**\n   * 检查角色要求\n   * 使用 CASL Ability 统一鉴权方式\n   * @param requirement 角色要求\n   * @param userId 用户ID,匿名用户时为空\n   * @returns 用户权限数据\n   * @throws PermissionDeniedException 当角色不满足时\n   */\n  async checkRoles(\n    requirement: RoleRequirement,\n    userContext?: UserContext\n  ): Promise<UserPermissionData> {\n    const userId = userContext?.userId || ANONYMOUS_USER_ID;\n    const permissionData = await this.getUserPermissions({\n      baseUrl: userContext?.baseUrl || '',\n      userId,\n      appId: userContext?.appId || '',\n      cookies: userContext?.cookies || {},\n      csrfToken: userContext?.csrfToken || '',\n    });\n    if (!permissionData) {\n      throw new PermissionDeniedException(\n        {\n          cause: new Error('Permission data fetch api is not configured'),\n          type: PermissionDeniedType.PERMISSION_CONFIG_QUERY_FAILED,\n          message: 'Permission data fetch api is not configured',\n        },\n        HttpStatus.BAD_REQUEST\n      );\n    }\n\n    // 创建 Ability 实例\n    const ability = this.abilityFactory.createForUser(permissionData);\n\n    const { roles, and } = requirement;\n\n    // 使用 CASL 统一检查角色权限\n    // 角色作为 action，'@role' 作为 subject\n    const checkResults = roles.map(role => ability.can(role, ROLE_SUBJECT));\n\n    const hasRole = and\n      ? checkResults.every(result => result)\n      : checkResults.some(result => result);\n\n    if (!hasRole) {\n      const userRoles = permissionData.roles;\n      this.logger.warn(\n        `角色检查失败: 用户 ${userId}, 用户角色 [${userRoles.join(', ')}], 需要 [${roles.join(', ')}]`\n      );\n      throw PermissionDeniedException.roleRequired(roles, and);\n    }\n\n    return permissionData;\n  }\n\n  // /**\n  //  * 检查权限要求\n  //  * @param requirements 权限要求列表\n  //  * @param userId 用户ID\n  //  * @returns 用户权限数据\n  //  * @throws PermissionDeniedException 当权限不满足时\n  //  */\n  // async checkPermissions(\n  //   params: CheckPermissionsParams,\n  //   userId?: string,\n  //   mockRoles?: string[]\n  // ): Promise<UserPermissionData> {\n  //   // 获取权限数据（用于返回）\n  //   const permissionData = await this.getUserPermissions(userId, mockRoles);\n  //   if (!permissionData) {\n  //     throw new PermissionDeniedException(\n  //       {\n  //         cause: new Error('Permission data fetch api is not configured'),\n  //         type: PermissionDeniedType.PERMISSION_CONFIG_QUERY_FAILED,\n  //         message: 'Permission data fetch api is not configured',\n  //       },\n  //       HttpStatus.BAD_REQUEST\n  //     );\n  //   }\n  //   const { requirements, or } = params;\n  //   if (!requirements || requirements.length === 0) {\n  //     return permissionData;\n  //   }\n\n  //   // 获取缓存的 Ability 实例\n  //   const ability = await this.getUserAbility(userId, mockRoles);\n\n  //   // 收集所有失败的权限要求\n  //   const failedRequirements: Array<{\n  //     actions: string[];\n  //     subject: string;\n  //     or: boolean;\n  //   }> = [];\n\n  //   // 检查每个权限要求\n  //   for (const requirement of requirements) {\n  //     const { actions, subject, or = false } = requirement;\n\n  //     // 使用缓存的 Ability 实例检查权限\n  //     const checkResults = actions.map(action => ability.can(action, subject));\n\n  //     // 根据 or 决定是 AND 还是 OR 逻辑\n  //     const hasPermission = or\n  //       ? checkResults.some(result => result)\n  //       : checkResults.every(result => result);\n\n  //     if (!hasPermission) {\n  //       failedRequirements.push({\n  //         actions,\n  //         subject: String(subject),\n  //         or,\n  //       });\n  //     }\n  //   }\n\n  //   // 如果有失败的权限要求，抛出异常\n  //   if (failedRequirements.length > 0) {\n  //     if (or && failedRequirements.length === requirements.length) {\n  //       throw PermissionDeniedException.permissionRequired(\n  //         failedRequirements.map(({ actions, subject }) => ({\n  //           actions,\n  //           subject: String(subject),\n  //         })),\n  //         true\n  //       );\n  //     } else if (!or) {\n  //       throw PermissionDeniedException.permissionRequired(\n  //         failedRequirements.map(({ actions, subject }) => ({\n  //           actions,\n  //           subject: String(subject),\n  //         })),\n  //         false\n  //       );\n  //     }\n  //   }\n  //   return permissionData;\n  // }\n}\n","import { DynamicModule, Module } from '@nestjs/common';\nimport { APP_GUARD, Reflector } from '@nestjs/core';\nimport { AuthNPaasModuleOptions } from './types';\nimport { AUTHNPAAS_MODULE_OPTIONS } from './const';\nimport { AuthNPaasGuard } from './guards/authnpaas.guard';\n\n@Module({})\nexport class AuthNPaasModule {\n  static forRoot(options?: AuthNPaasModuleOptions): DynamicModule {\n    return {\n      module: AuthNPaasModule,\n      global: true,\n      controllers: [],\n      providers: [\n        // 配置提供者\n        {\n          provide: AUTHNPAAS_MODULE_OPTIONS,\n          useValue: {\n            ...(options || {}),\n          },\n        },\n        // 核心服务\n        Reflector,\n        // 服务提供者\n        AuthNPaasGuard,\n        // 守卫提供者\n        {\n          provide: APP_GUARD,\n          useClass: AuthNPaasGuard,\n        },\n      ],\n      exports: [],\n    };\n  }\n}\n","/**\n * 常量\n */\n\n/** AuthNPaas 模块选项 Token */\nexport const AUTHNPAAS_MODULE_OPTIONS = Symbol('AUTHNPAAS_MODULE_OPTIONS');\n\n/**\n * 元数据键\n */\n\n/** 需要登录元数据键 */\nexport const NEED_LOGIN_KEY = 'authnpaas:needLogin';\n","import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';\nimport { Response } from 'express';\nimport { Reflector } from '@nestjs/core';\nimport { NEED_LOGIN_KEY } from '../const';\n\n/**\n * AuthNPaas 守卫\n * 负责协调所有鉴权检查，具体检查逻辑委托给 PermissionService\n */\n@Injectable()\nexport class AuthNPaasGuard implements CanActivate {\n  constructor(private reflector: Reflector) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const http = context.switchToHttp();\n    const request = http.getRequest();\n    const response = http.getResponse<Response>();\n\n    const { userId, loginUrl } = request.userContext || {};\n\n    // 读取 NeedLogin 元数据并标记到请求对象，供异常过滤器使用\n    const needLoginMeta = this.reflector.getAllAndOverride<{\n      loginPath?: string;\n    }>(NEED_LOGIN_KEY, [context.getHandler(), context.getClass()]);\n\n    // NeedLogin 且无 userId -> 在守卫内直接重定向并拦截\n    if (needLoginMeta && !userId && loginUrl) {\n      response.redirect(302, loginUrl);\n      return false;\n    }\n\n    return true;\n  }\n}\n","import { SetMetadata } from '@nestjs/common';\n\n/**\n * Public 装饰器的元数据键\n */\nexport const IS_PUBLIC_KEY = 'isPublic';\n\n/**\n * 标记接口为公开接口，跳过 AuthNPaasGuard 的鉴权检查\n * \n * @example\n * ```typescript\n * @Controller('mock-api/users')\n * @Public()  // 控制器级别\n * export class MockPermissionController {\n *   @Get(':userId/permissions')\n *   getUserPermissions() {}\n * }\n * \n * // 或者在方法级别\n * @Controller('api')\n * export class ApiController {\n *   @Get('public-info')\n *   @Public()  // 方法级别\n *   getPublicInfo() {}\n * }\n * ```\n */\nexport const Public = () => SetMetadata(IS_PUBLIC_KEY, true);\n\n","import { SetMetadata } from '@nestjs/common';\nimport { NEED_LOGIN_KEY } from '../const';\n\n/**\n * NeedLogin 装饰器\n * 标记接口需要登录。如果鉴权失败（如 401/403），异常过滤器会将请求重定向到登录页。\n * 可选地传入登录页路径，默认 '/login'。\n */\nexport const NeedLogin = (loginPath?: string): MethodDecorator & ClassDecorator => {\n  return SetMetadata(NEED_LOGIN_KEY, { loginPath });\n};\n\n\n","/**\n * 常量\n */\n\n/** 匿名用户 ID */\nexport const ANONYMOUS_USER_ID = 'anonymous_user_id';\n\n/**\n * 依赖注入 Token\n */\n\n/** 权限 API 配置 Token */\nexport const PERMISSION_API_CONFIG_TOKEN = Symbol('PERMISSION_API_CONFIG');\n\n/** 缓存配置 Token */\nexport const CACHE_CONFIG_TOKEN = Symbol('CACHE_CONFIG');\n\n/** AuthZPaas 模块选项 Token */\nexport const AUTHZPAAS_MODULE_OPTIONS = Symbol('AUTHZPAAS_MODULE_OPTIONS');\n\n/**\n * 元数据键\n */\n\n/** 需要的角色元数据键 */\nexport const ROLES_KEY = 'authzpaas:roles';\n\n/** 需要的权限元数据键 */\nexport const PERMISSIONS_KEY = 'authzpaas:permissions';\n\n/** 需要的环境元数据键 */\nexport const ENVIRONMENT_KEY = 'authzpaas:environment';\n\n/** 需要登录元数据键 */\nexport const NEED_LOGIN_KEY = 'authzpaas:needLogin';\n\n/** 模块选项：登录页路径默认值 */\nexport const DEFAULT_LOGIN_PATH = '/login';\n\n/** 角色模拟的 Cookie 键名 */\nexport const MOCK_ROLES_COOKIE_KEY = 'mockRoles';\n\nexport const ENABLE_MOCK_ROLE_KEY = '__authzpaas_enableMockRole';\n","import { Injectable } from '@nestjs/common';\nimport { AbilityBuilder, PureAbility, AbilityClass } from '@casl/ability';\nimport { UserPermissionData, Action, Subject } from '../types';\n\n/**\n * CASL Ability 类型\n */\nexport type AppAbility = PureAbility<[Action, Subject]>;\n\n/**\n * 角色检查的特殊 Subject\n * 用于统一角色鉴权和权限点位鉴权\n * \n * 使用方式：\n * - 权限点位鉴权：ability.can('read', 'Todo')\n * - 角色鉴权：ability.can('admin', ROLE_SUBJECT) 或 ability.can('admin', '@role')\n */\nexport const ROLE_SUBJECT = '@role';\n\n/**\n * Ability 工厂\n * 负责根据用户权限数据创建 CASL Ability 实例\n * \n * 统一了两种鉴权方式：\n * 1. 基于角色的鉴权 - 角色名作为 action，'@role' 作为 subject\n * 2. 基于权限点位的鉴权 - 标准的 action + subject 模式\n */\n@Injectable()\nexport class AbilityFactory {\n  /**\n   * 为用户创建 Ability\n   */\n  createForUser(permissionData: UserPermissionData): AppAbility {\n    const { can, build } = new AbilityBuilder<AppAbility>(\n      PureAbility as AbilityClass<AppAbility>,\n    );\n\n    // TODO: 基于权限点位设置能力\n    // for (const permission of permissionData.permissions) {\n    //   const { sub, actions } = permission;\n      \n    //   // 为每个 action 添加权限\n    //   for (const action of actions) {\n    //     can(action as Action, sub);\n    //   }\n    // }\n\n    // 基于角色设置能力\n    for (const role of permissionData.roles) {\n      can(role as Action, ROLE_SUBJECT);\n    }\n\n    return build();\n  }\n}\n","import { HttpException } from '@nestjs/common';\n\n/**\n * 权限拒绝异常类型\n */\nexport enum PermissionDeniedType {\n  /** 用户未认证 */\n  UNAUTHENTICATED = 'UNAUTHENTICATED',\n  /** 缺少角色 */\n  ROLE_REQUIRED = 'ROLE_REQUIRED',\n  /** 缺少权限 */\n  PERMISSION_REQUIRED = 'PERMISSION_REQUIRED',\n  /** 权限配置查询失败 */\n  PERMISSION_CONFIG_QUERY_FAILED = 'PERMISSION_CONFIG_QUERY_FAILED',\n}\n\n/**\n * 权限拒绝异常详情\n */\nexport interface PermissionDeniedDetails {\n  /** 错误堆栈 */\n  cause?: Error;\n  /** 异常类型 */\n  type: PermissionDeniedType;\n  /** 错误消息 */\n  message: string;\n  /** 需要的角色（如果适用） */\n  requiredRoles?: string[];\n  /** 需要的权限（如果适用） */\n  requiredPermissions?: Array<{\n    actions: string[];\n    subject: string;\n  }>;\n  /** 环境要求（如果适用） */\n  environmentRequirement?: string;\n  /** 额外信息 */\n  metadata?: Record<string, unknown>;\n}\n\n/**\n * 权限拒绝异常\n * 专门用于 AuthZPaas 模块的权限检查失败场景\n */\nexport class PermissionDeniedException extends HttpException {\n  public readonly type: PermissionDeniedType;\n  public readonly details: PermissionDeniedDetails;\n\n  constructor(details: PermissionDeniedDetails, httpStatusCode: number = 403) {\n    super(\n      {\n        statusCode: httpStatusCode,\n        cause: details.cause,\n        type: details.type,\n        message: details.message,\n        ...(details.requiredRoles && { requiredRoles: details.requiredRoles }),\n        ...(details.requiredPermissions && {\n          requiredPermissions: details.requiredPermissions,\n        }),\n        ...(details.environmentRequirement && {\n          environmentRequirement: details.environmentRequirement,\n        }),\n        ...(details.metadata && { metadata: details.metadata }),\n      },\n      httpStatusCode\n    );\n\n    this.type = details.type;\n    this.details = details;\n    this.name = 'PermissionDeniedException';\n  }\n\n  /**\n   * 创建用户未认证异常\n   */\n  static unauthenticated(\n    message: string = '用户未认证'\n  ): PermissionDeniedException {\n    return new PermissionDeniedException({\n      type: PermissionDeniedType.UNAUTHENTICATED,\n      message,\n    });\n  }\n\n  /**\n   * 创建角色不足异常\n   */\n  static roleRequired(\n    requiredRoles: string[],\n    and: boolean = false\n  ): PermissionDeniedException {\n    const message = and\n      ? `需要所有角色: ${requiredRoles.join(', ')}`\n      : `需要以下任一角色: ${requiredRoles.join(', ')}`;\n\n    return new PermissionDeniedException({\n      type: PermissionDeniedType.ROLE_REQUIRED,\n      message,\n      requiredRoles,\n      metadata: { and },\n    });\n  }\n\n  /**\n   * 创建权限不足异常\n   */\n  static permissionRequired(\n    requiredPermissions: Array<{ actions: string[]; subject: string }>,\n    or: boolean = false,\n    customMessage?: string\n  ): PermissionDeniedException {\n    let message: string;\n\n    if (customMessage) {\n      message = customMessage;\n    } else if (requiredPermissions.length === 1) {\n      const perm = requiredPermissions[0];\n      message = or\n        ? `缺少权限: 需要对 ${perm.subject} 执行以下任一操作 [${perm.actions.join(', ')}]`\n        : `缺少权限: 需要对 ${perm.subject} 执行所有操作 [${perm.actions.join(', ')}]`;\n    } else {\n      message = or\n        ? `缺少权限: 需要满足以下任一权限要求: ${requiredPermissions.map(({ actions, subject }) => `对 ${subject} 执行以下任一操作 [${actions.join(', ')}]`).join(', ')}`\n        : `缺少权限: 需要满足以下所有权限要求: ${requiredPermissions.map(({ actions, subject }) => `对 ${subject} 执行所有操作 [${actions.join(', ')}]`).join(', ')}`;\n    }\n\n    return new PermissionDeniedException({\n      type: PermissionDeniedType.PERMISSION_REQUIRED,\n      message,\n      requiredPermissions,\n      metadata: { or },\n    });\n  }\n}\n","import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\nimport { PermissionService } from '../services/permission.service';\nimport { ROLES_KEY } from '../const';\nimport { RoleRequirement, CheckRoleRequirement } from '../decorators';\nimport { UserContext } from '../types';\n\n/**\n * AuthZPaas 守卫\n * 负责协调所有鉴权检查，具体检查逻辑委托给 PermissionService\n */\n@Injectable()\nexport class AuthZPaasGuard implements CanActivate {\n  constructor(\n    private reflector: Reflector,\n    private permissionService: PermissionService\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const http = context.switchToHttp();\n    const request = http.getRequest();\n\n    const userContext = request.userContext as UserContext;\n\n    // 检查角色要求\n    const checkRoleRequirement =\n      this.reflector.getAllAndOverride<CheckRoleRequirement>(ROLES_KEY, [\n        context.getHandler(),\n        context.getClass(),\n      ]);\n\n    if (checkRoleRequirement) {\n      await this.checkRoleRequirement(checkRoleRequirement, userContext);\n    }\n\n    // // 检查权限要求\n    // const checkPermissionParams =\n    //   this.reflector.getAllAndOverride<CheckPermissionsParams>(\n    //     PERMISSIONS_KEY,\n    //     [context.getHandler(), context.getClass()]\n    //   );\n\n    // if (checkPermissionParams) {\n    //   await this.checkPermissionRequirement(\n    //     checkPermissionParams,\n    //     userId,\n    //     mockRoles\n    //   );\n    // }\n\n    return true;\n  }\n\n  /**\n   * 检查角色要求\n   */\n  private async checkRoleRequirement(\n    requirement: RoleRequirement,\n    userContext?: UserContext\n  ) {\n    return this.permissionService.checkRoles(requirement, userContext);\n  }\n\n  // /**\n  //  * 检查权限要求\n  //  */\n  // private async checkPermissionRequirement(\n  //   params: CheckPermissionsParams,\n  //   userId?: string,\n  //   mockRoles?: string[]\n  // ) {\n  //   return this.permissionService.checkPermissions(params, userId, mockRoles);\n  // }\n}\n","import { Injectable, NestMiddleware, Logger } from '@nestjs/common';\nimport { Request, Response, NextFunction } from 'express';\nimport { PermissionService } from '../services/permission.service';\n\nimport { UserContext } from '../types';\n\n/**\n * 扩展 Express Request 类型，添加用户权限相关字段\n */\n// eslint-disable-next-line @typescript-eslint/no-namespace\ndeclare global {\n  // eslint-disable-next-line @typescript-eslint/no-namespace\n  namespace Express {\n    interface Request {\n      userContext: UserContext;\n    }\n  }\n}\n\n@Injectable()\nexport class RolesMiddleware implements NestMiddleware {\n  private readonly logger = new Logger(RolesMiddleware.name);\n  constructor(private readonly permissionService: PermissionService) {}\n\n  async use(req: Request, _res: Response, next: NextFunction) {\n    try {\n      // 1. 从请求中提取 baseUrl, userId, appId, cookie, X-Suda-Csrf-Token header\n      const baseUrl = `${req.protocol}://${req.get('host')}`;\n      const userId = req.userContext?.userId ?? '';\n      const appId = req.userContext?.appId ?? '';\n      const cookies = req.cookies ?? {};\n      const csrfToken = (req.headers['x-suda-csrf-token'] as string) ?? '';\n\n      // 2. 通过 PermissionService 获取用户权限数据\n      this.logger.debug(`Fetching roles for user: ${userId}`);\n      const permissionData = await this.permissionService.getUserPermissions({\n        baseUrl,\n        userId,\n        appId,\n        cookies,\n        csrfToken,\n      });\n      let roles;\n      if (permissionData) {\n        roles = permissionData.roles;\n      }\n      // 3. 将 roles 附加到 userContext\n      req.userContext.baseUrl = baseUrl;\n      req.userContext.userRoles = roles;\n      req.userContext.userId = userId;\n      req.userContext.cookies = cookies;\n      req.userContext.csrfToken = csrfToken;\n\n      // 4. 记录日志\n      this.logger.debug(`User ${userId} roles loaded: [${roles?.join(', ')}]`);\n\n      next();\n    } catch (error) {\n      // 获取权限失败时，记录错误但不阻塞请求\n      // 让后续的 Guard 来处理权限验证\n      this.logger.warn(\n        `Failed to fetch roles for request: ${error instanceof Error ? error.message : 'Unknown error'}`\n      );\n      next();\n    }\n  }\n}\n","import { ExceptionFilter, Catch, ArgumentsHost } from '@nestjs/common';\nimport { Response } from 'express';\nimport { PermissionDeniedException } from '../exceptions/permission-denied.exception';\n\n/**\n * AuthZPaas 异常过滤器\n * 确保权限错误信息能够正确返回给客户端\n */\n@Catch(PermissionDeniedException)\nexport class AuthZPaasExceptionFilter implements ExceptionFilter {\n  catch(exception: PermissionDeniedException, host: ArgumentsHost) {\n    const ctx = host.switchToHttp();\n    const response = ctx.getResponse<Response>();\n    const status = exception.getStatus();\n    const exceptionResponse = exception.getResponse();\n\n    // 格式化错误响应\n    const errorResponse: any = {\n      statusCode: status,\n      timestamp: new Date().toISOString(),\n      cause: exception.cause,\n      type: exception.type,\n      message:\n        typeof exceptionResponse === 'string'\n          ? exceptionResponse\n          : (exceptionResponse as any).message || '权限不足',\n    };\n\n    // 添加详细信息\n    if (exception.details.requiredRoles) {\n      errorResponse.requiredRoles = exception.details.requiredRoles;\n    }\n\n    if (exception.details.requiredPermissions) {\n      errorResponse.requiredPermissions = exception.details.requiredPermissions;\n    }\n\n    if (exception.details.metadata) {\n      errorResponse.metadata = exception.details.metadata;\n    }\n\n    response.status(status).json(errorResponse);\n  }\n}\n","import { SetMetadata } from '@nestjs/common';\nimport { ROLES_KEY } from '../const';\n\n/**\n * 角色要求配置\n */\nexport interface RoleRequirement {\n  /** 需要的角色列表 */\n  roles: string[];\n  /** 是否需要所有角色（AND），默认 false（OR） */\n  and?: boolean;\n}\n\nexport type CheckRoleRequirement = RoleRequirement;\n\n/**\n * 要求用户拥有指定角色\n * \n * @example\n * ```typescript\n * // 需要任一角色\n * @CanRole(['admin', 'moderator'])\n * async deleteUser() {}\n * \n * // 需要所有角色\n * @CanRole(['admin', 'superuser'], true)\n * async criticalOperation() {}\n * ```\n */\nexport const CanRole = (\n  role: string[] | string,\n  and: boolean = false,\n): MethodDecorator => {\n  // 解析参数\n  let requirement: RoleRequirement;\n\n  if (!Array.isArray(role) && typeof role === 'string') {\n    // 对象形式\n    requirement = {\n      roles: [role],\n      and: and,\n    };\n  } else if (Array.isArray(role) && role.some((role) => typeof role === 'string')) {\n    // 字符串列表形式\n    requirement = {\n      roles: role as string[],\n      and: and,\n    };\n  } else {\n    throw new Error('Invalid CanRole parameter: ' + JSON.stringify(role));\n  }\n\n  return SetMetadata(ROLES_KEY, requirement);\n};\n"],"mappings":";;;;AAAA,SAAwBA,UAAAA,eAAoB;AAC5C,SAASC,YAAYC,aAAAA,YAAWC,aAAAA,kBAAiB;;;ACDjD,SAASC,cAAAA,aAAYC,QAAQC,YAAYC,cAAc;;;ACAvD,SAAwBC,cAAc;AACtC,SAASC,WAAWC,aAAAA,kBAAiB;AEDrC,SAASC,kBAAiD;AAE1D,SAASD,iBAAiB;ACF1B,SAASE,mBAAmB;ACA5B,SAASA,eAAAA,oBAAmB;;;;;;AHKrB,IAAMC,2BAA2BC,OAAO,0BAAA;AAOxC,IAAMC,iBAAiB;;;;;;;;;;;;;;ACFvB,IAAMC,iBAAN,MAAMA;SAAAA;;;SAAAA;;;;EACX,YAAoBC,WAAsB;SAAtBA,YAAAA;EAAuB;EAE3C,MAAMC,YAAYC,SAA6C;AAC7D,UAAMC,OAAOD,QAAQE,aAAY;AACjC,UAAMC,UAAUF,KAAKG,WAAU;AAC/B,UAAMC,WAAWJ,KAAKK,YAAW;AAEjC,UAAM,EAAEC,QAAQC,SAAQ,IAAKL,QAAQM,eAAe,CAAC;AAGrD,UAAMC,gBAAgB,KAAKZ,UAAUa,kBAElCf,gBAAgB;MAACI,QAAQY,WAAU;MAAIZ,QAAQa,SAAQ;KAAG;AAG7D,QAAIH,iBAAiB,CAACH,UAAUC,UAAU;AACxCH,eAASS,SAAS,KAAKN,QAAAA;AACvB,aAAO;IACT;AAEA,WAAO;EACT;AACF;;;;;;;;;;;;;;;;AF1BO,IAAMO,kBAAN,MAAMA,iBAAAA;SAAAA;;;SAAAA;;;EACX,OAAOC,QAAQC,SAAiD;AAC9D,WAAO;MACLC,QAAQH;MACRI,QAAQ;MACRC,aAAa,CAAA;MACbC,WAAW;;QAET;UACEC,SAAS5B;UACT6B,UAAU;YACR,GAAIN,WAAW,CAAC;UAClB;QACF;;QAEAO;;QAEA3B;;QAEA;UACEyB,SAASG;UACTC,UAAU7B;QACZ;;MAEF8B,SAAS,CAAA;IACX;EACF;AACF;;;;AG7BO,IAAMC,gBAAgB;AAuBtB,IAAMC,SAAS,gBAAAC,QAAA,MAAMC,YAAYH,eAAe,IAAA,GAAjC,QAAA;;;AEvBf,IAAMI,oBAAoB;AAO1B,IAAMC,8BAA8BC,OAAO,uBAAA;AAG3C,IAAMC,qBAAqBD,OAAO,cAAA;AAGlC,IAAME,2BAA2BF,OAAO,0BAAA;AAOxC,IAAMG,YAAY;AAGlB,IAAMC,kBAAkB;AAGxB,IAAMC,kBAAkB;AAGxB,IAAMC,kBAAiB;AAGvB,IAAMC,qBAAqB;AAG3B,IAAMC,wBAAwB;AAE9B,IAAMC,uBAAuB;;;AC1CpC,SAASC,cAAAA,mBAAkB;AAC3B,SAASC,gBAAgBC,mBAAiC;;;;;;;;AAgBnD,IAAMC,eAAe;AAWrB,IAAMC,iBAAN,MAAMA;SAAAA;;;;;;EAIXC,cAAcC,gBAAgD;AAC5D,UAAM,EAAEC,KAAKC,MAAK,IAAK,IAAIC,eACzBC,WAAAA;AAcF,eAAWC,QAAQL,eAAeM,OAAO;AACvCL,UAAII,MAAgBR,YAAAA;IACtB;AAEA,WAAOK,MAAAA;EACT;AACF;;;;;;ACtDA,SAASK,qBAAqB;AAKvB,IAAKC,uBAAAA,0BAAAA,uBAAAA;AACA,EAAAA,sBAAA,iBAAA,IAAA;AAED,EAAAA,sBAAA,eAAA,IAAA;AAEA,EAAAA,sBAAA,qBAAA,IAAA;AAEI,EAAAA,sBAAA,gCAAA,IAAA;SAPHA;;AAsCL,IAAMC,4BAAN,MAAMA,mCAAkCC,cAAAA;EA3C/C,OA2C+CA;;;EAC7BC;EACAC;EAEhB,YAAYA,SAAkCC,iBAAyB,KAAK;AAC1E,UACE;MACEC,YAAYD;MACZE,OAAOH,QAAQG;MACfJ,MAAMC,QAAQD;MACdK,SAASJ,QAAQI;MACjB,GAAIJ,QAAQK,iBAAiB;QAAEA,eAAeL,QAAQK;MAAc;MACpE,GAAIL,QAAQM,uBAAuB;QACjCA,qBAAqBN,QAAQM;MAC/B;MACA,GAAIN,QAAQO,0BAA0B;QACpCA,wBAAwBP,QAAQO;MAClC;MACA,GAAIP,QAAQQ,YAAY;QAAEA,UAAUR,QAAQQ;MAAS;IACvD,GACAP,cAAAA;AAGF,SAAKF,OAAOC,QAAQD;AACpB,SAAKC,UAAUA;AACf,SAAKS,OAAO;EACd;;;;EAKA,OAAOC,gBACLN,UAAkB,kCACS;AAC3B,WAAO,IAAIP,2BAA0B;MACnCE,MAAI;MACJK;IACF,CAAA;EACF;;;;EAKA,OAAOO,aACLN,eACAO,MAAe,OACY;AAC3B,UAAMR,UAAUQ,MACZ,yCAAWP,cAAcQ,KAAK,IAAA,CAAA,KAC9B,qDAAaR,cAAcQ,KAAK,IAAA,CAAA;AAEpC,WAAO,IAAIhB,2BAA0B;MACnCE,MAAI;MACJK;MACAC;MACAG,UAAU;QAAEI;MAAI;IAClB,CAAA;EACF;;;;EAKA,OAAOE,mBACLR,qBACAS,KAAc,OACdC,eAC2B;AAC3B,QAAIZ;AAEJ,QAAIY,eAAe;AACjBZ,gBAAUY;IACZ,WAAWV,oBAAoBW,WAAW,GAAG;AAC3C,YAAMC,OAAOZ,oBAAoB,CAAA;AACjCF,gBAAUW,KACN,gDAAaG,KAAKC,OAAO,sDAAcD,KAAKE,QAAQP,KAAK,IAAA,CAAA,MACzD,gDAAaK,KAAKC,OAAO,0CAAYD,KAAKE,QAAQP,KAAK,IAAA,CAAA;IAC7D,OAAO;AACLT,gBAAUW,KACN,uGAAuBT,oBAAoBe,IAAI,CAAC,EAAED,SAASD,QAAO,MAAO,UAAKA,OAAAA,sDAAqBC,QAAQP,KAAK,IAAA,CAAA,GAAQ,EAAEA,KAAK,IAAA,CAAA,KAC/H,uGAAuBP,oBAAoBe,IAAI,CAAC,EAAED,SAASD,QAAO,MAAO,UAAKA,OAAAA,0CAAmBC,QAAQP,KAAK,IAAA,CAAA,GAAQ,EAAEA,KAAK,IAAA,CAAA;IACnI;AAEA,WAAO,IAAIhB,2BAA0B;MACnCE,MAAI;MACJK;MACAE;MACAE,UAAU;QAAEO;MAAG;IACjB,CAAA;EACF;AACF;;;;;;;;;;;;;;;;;;;;AR7GO,IAAMO,oBAAN,MAAMA,mBAAAA;SAAAA;;;;;EACMC,SAAS,IAAIC,OAAOF,mBAAkBG,IAAI;EAE3D,YAEmBC,WACAC,gBACjB;SAFiBD,YAAAA;SACAC,iBAAAA;EAChB;;;;EAKH,MAAMC,mBACJC,YACoC;AAEpC,UAAMC,kBAAkB,YAAA;AACtB,YAAMC,SAASF,WAAWE,UAAUC;AACpC,UAAI;AACF,cAAMC,iBAAiB,MAAM,KAAKC,aAAaL,UAAAA;AAE/C,cAAMM,oBAAwC;UAC5C,GAAGF;UACHG,WAAW,oBAAIC,KAAAA;QACjB;AAEA,eAAOF;MACT,SAASG,OAAO;AACd,aAAKf,OAAOe,MACV,wCAAwCP,MAAAA,KACxCO,KAAAA;AAEF,cAAMA;MACR;IACF,GAAA;AAEA,WAAOR;EACT;;;;;EAMA,MAAcI,aACZL,YAC6B;AAC7B,UAAM,EAAEU,UAAU,IAAI,IAAK,KAAKb,aAAa,CAAC;AAC9C,UAAM,EAAEc,SAAST,QAAQU,OAAOC,SAASC,UAAS,IAAKd;AAGvD,UAAMe,MAAM,GAAGJ,OAAAA,aAAoBC,KAAAA;AAGnC,UAAMI,iBAAyC;MAC7C,gBAAgB;IAClB;AAEA,QAAIH,SAAS;AACX,YAAMI,eAAeC,OAAOC,QAAQN,OAAAA,EACjCO,IAAI,CAAC,CAACC,KAAKC,KAAAA,MAAW,GAAGD,GAAAA,IAAOC,KAAAA,EAAO,EACvCC,KAAK,IAAA;AACR,UAAIN,cAAc;AAChBD,uBAAeQ,SAASP;MAC1B;IACF;AAEA,QAAIH,WAAW;AACbE,qBAAe,mBAAA,IAAuBF;IACxC;AAGA,UAAMW,aAAa,IAAIC,gBAAAA;AACvB,UAAMC,YAAYC,WAAW,MAAMH,WAAWI,MAAK,GAAInB,OAAAA;AAEvD,QAAI;AACF,YAAMoB,WAAW,MAAMC,MAAMhB,KAAK;QAChCiB,QAAQ;QACRC,SAASjB;QACTkB,QAAQT,WAAWS;MACrB,CAAA;AAEAC,mBAAaR,SAAAA;AAEb,UAAI,CAACG,SAASM,IAAI;AAChB,cAAM3B,QAAQ,IAAI4B,MAChB,2BAA2BP,SAASQ,MAAM,KAAKR,SAASS,UAAU,EAAE;AAEtE,cAAM,IAAIC,0BACR;UACEC,OAAOhC;UACPiC,MAAMC,qBAAqBC;UAC3BC,SAASpC,MAAMoC;QACjB,GACAC,WAAWC,qBAAqB;MAEpC;AAEA,YAAMC,OAAQ,MAAMlB,SAASmB,KAAI;AAIjC,aAAO;QACL/C;QACAgD,OAAOF,KAAKG,aAAa,CAAA;;;QAGzB5C,WAAW,oBAAIC,KAAAA;MACjB;IACF,SAASC,OAAgB;AACvB0B,mBAAaR,SAAAA;AACb,UAAIyB,MAAM3C;AAEV,UAAKA,MAA4Bb,SAAS,cAAc;AACtDwD,cAAM,IAAIf,MAAM,wCAAwC3B,OAAAA,IAAW;MACrE;AAEA,YAAM,IAAI8B,0BACR;QACEC,OAAOW;QACPV,MAAMC,qBAAqBC;QAC3BC,SAASO,IAAIP;MACf,GACAC,WAAWC,qBAAqB;IAEpC;EACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoCA,MAAMM,WACJC,aACAC,aAC6B;AAC7B,UAAMrD,SAASqD,aAAarD,UAAUC;AACtC,UAAMC,iBAAiB,MAAM,KAAKL,mBAAmB;MACnDY,SAAS4C,aAAa5C,WAAW;MACjCT;MACAU,OAAO2C,aAAa3C,SAAS;MAC7BC,SAAS0C,aAAa1C,WAAW,CAAC;MAClCC,WAAWyC,aAAazC,aAAa;IACvC,CAAA;AACA,QAAI,CAACV,gBAAgB;AACnB,YAAM,IAAIoC,0BACR;QACEC,OAAO,IAAIJ,MAAM,6CAAA;QACjBK,MAAMC,qBAAqBC;QAC3BC,SAAS;MACX,GACAC,WAAWU,WAAW;IAE1B;AAGA,UAAMC,UAAU,KAAK3D,eAAe4D,cAActD,cAAAA;AAElD,UAAM,EAAE8C,OAAOS,IAAG,IAAKL;AAIvB,UAAMM,eAAeV,MAAM9B,IAAIyC,CAAAA,SAAQJ,QAAQK,IAAID,MAAME,YAAAA,CAAAA;AAEzD,UAAMC,UAAUL,MACZC,aAAaK,MAAMC,CAAAA,WAAUA,MAAAA,IAC7BN,aAAaO,KAAKD,CAAAA,WAAUA,MAAAA;AAEhC,QAAI,CAACF,SAAS;AACZ,YAAMI,YAAYhE,eAAe8C;AACjC,WAAKxD,OAAO2E,KACV,sDAAcnE,MAAAA,+BAAiBkE,UAAU7C,KAAK,IAAA,CAAA,oBAAe2B,MAAM3B,KAAK,IAAA,CAAA,GAAQ;AAElF,YAAMiB,0BAA0B8B,aAAapB,OAAOS,GAAAA;IACtD;AAEA,WAAOvD;EACT;AAoFF;;;;;;;;;;;;;ASzTA,SAASmE,cAAAA,mBAAiD;AAC1D,SAASC,aAAAA,kBAAiB;;;;;;;;;;;;AAWnB,IAAMC,iBAAN,MAAMA;SAAAA;;;;;EACX,YACUC,WACAC,mBACR;SAFQD,YAAAA;SACAC,oBAAAA;EACP;EAEH,MAAMC,YAAYC,SAA6C;AAC7D,UAAMC,OAAOD,QAAQE,aAAY;AACjC,UAAMC,UAAUF,KAAKG,WAAU;AAE/B,UAAMC,cAAcF,QAAQE;AAG5B,UAAMC,uBACJ,KAAKT,UAAUU,kBAAwCC,WAAW;MAChER,QAAQS,WAAU;MAClBT,QAAQU,SAAQ;KACjB;AAEH,QAAIJ,sBAAsB;AACxB,YAAM,KAAKA,qBAAqBA,sBAAsBD,WAAAA;IACxD;AAiBA,WAAO;EACT;;;;EAKA,MAAcC,qBACZK,aACAN,aACA;AACA,WAAO,KAAKP,kBAAkBc,WAAWD,aAAaN,WAAAA;EACxD;AAYF;;;;;;;;;;;ACzEA,SAASQ,cAAAA,aAA4BC,UAAAA,eAAc;;;;;;;;;;;;AAoB5C,IAAMC,kBAAN,MAAMA,iBAAAA;SAAAA;;;;EACMC,SAAS,IAAIC,QAAOF,iBAAgBG,IAAI;EACzD,YAA6BC,mBAAsC;SAAtCA,oBAAAA;EAAuC;EAEpE,MAAMC,IAAIC,KAAcC,MAAgBC,MAAoB;AAC1D,QAAI;AAEF,YAAMC,UAAU,GAAGH,IAAII,QAAQ,MAAMJ,IAAIK,IAAI,MAAA,CAAA;AAC7C,YAAMC,SAASN,IAAIO,aAAaD,UAAU;AAC1C,YAAME,QAAQR,IAAIO,aAAaC,SAAS;AACxC,YAAMC,UAAUT,IAAIS,WAAW,CAAC;AAChC,YAAMC,YAAaV,IAAIW,QAAQ,mBAAA,KAAmC;AAGlE,WAAKhB,OAAOiB,MAAM,4BAA4BN,MAAAA,EAAQ;AACtD,YAAMO,iBAAiB,MAAM,KAAKf,kBAAkBgB,mBAAmB;QACrEX;QACAG;QACAE;QACAC;QACAC;MACF,CAAA;AACA,UAAIK;AACJ,UAAIF,gBAAgB;AAClBE,gBAAQF,eAAeE;MACzB;AAEAf,UAAIO,YAAYJ,UAAUA;AAC1BH,UAAIO,YAAYS,YAAYD;AAC5Bf,UAAIO,YAAYD,SAASA;AACzBN,UAAIO,YAAYE,UAAUA;AAC1BT,UAAIO,YAAYG,YAAYA;AAG5B,WAAKf,OAAOiB,MAAM,QAAQN,MAAAA,mBAAyBS,OAAOE,KAAK,IAAA,CAAA,GAAQ;AAEvEf,WAAAA;IACF,SAASgB,OAAO;AAGd,WAAKvB,OAAOwB,KACV,sCAAsCD,iBAAiBE,QAAQF,MAAMG,UAAU,eAAA,EAAiB;AAElGnB,WAAAA;IACF;EACF;AACF;;;;;;;;;;AClEA,SAA0BoB,aAA4B;;;;;;;;AAS/C,IAAMC,2BAAN,MAAMA;SAAAA;;;EACXC,MAAMC,WAAsCC,MAAqB;AAC/D,UAAMC,MAAMD,KAAKE,aAAY;AAC7B,UAAMC,WAAWF,IAAIG,YAAW;AAChC,UAAMC,SAASN,UAAUO,UAAS;AAClC,UAAMC,oBAAoBR,UAAUK,YAAW;AAG/C,UAAMI,gBAAqB;MACzBC,YAAYJ;MACZK,YAAW,oBAAIC,KAAAA,GAAOC,YAAW;MACjCC,OAAOd,UAAUc;MACjBC,MAAMf,UAAUe;MAChBC,SACE,OAAOR,sBAAsB,WACzBA,oBACCA,kBAA0BQ,WAAW;IAC9C;AAGA,QAAIhB,UAAUiB,QAAQC,eAAe;AACnCT,oBAAcS,gBAAgBlB,UAAUiB,QAAQC;IAClD;AAEA,QAAIlB,UAAUiB,QAAQE,qBAAqB;AACzCV,oBAAcU,sBAAsBnB,UAAUiB,QAAQE;IACxD;AAEA,QAAInB,UAAUiB,QAAQG,UAAU;AAC9BX,oBAAcW,WAAWpB,UAAUiB,QAAQG;IAC7C;AAEAhB,aAASE,OAAOA,MAAAA,EAAQe,KAAKZ,aAAAA;EAC/B;AACF;;;;;;;;;;;;;AZvBO,IAAMa,kBAAN,MAAMA,iBAAAA;SAAAA;;;EACX,OAAOC,QAAQC,SAAgD;AAC7D,UAAM,EAAEC,cAAa,IAAKD;AAC1B,WAAO;MACLE,QAAQJ;MACRK,QAAQ;MACRC,aAAa,CAAA;MACbC,WAAW;;QAET;UACEC,SAASC;UACTC,UAAU;YAAE,GAAGR;UAAQ;QACzB;QACA;UACEM,SAASG;UACTD,UAAUP;QACZ;;QAEAS;;QAEAC;QACAC;QACAC;QACAC;;QAEA;UACER,SAASS;UACTC,UAAUH;QACZ;QACA;UACEP,SAASW;UACTD,UAAUE;QACZ;;MAEFC,SAAS;QAACR;QAAmBC;QAAgBE;;IAC/C;EACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgCA,OAAOM,aAAapB,SAAqD;AACvE,UAAM,EAAEqB,UAAU,CAAA,GAAIC,SAAS,CAAA,GAAIC,WAAU,IAAKvB;AAElD,WAAO;MACLE,QAAQJ;MACRK,QAAQ;MACRkB;MACAjB,aAAa,CAAA;MACbC,WAAW;;QAET;UACEC,SAASC;UACTgB;UACAD;QACF;;QAEA;UACEhB,SAASG;UACTc,YAAY,wBAACC,kBAAAA;AACX,mBAAOA,cAAcvB;UACvB,GAFY;UAGZqB,QAAQ;YAACf;;QACX;;QAEAG;;QAEAC;QACAC;QACAC;QACAC;;QAEA;UACER,SAASS;UACTC,UAAUH;QACZ;QACA;UACEP,SAASW;UACTD,UAAUE;QACZ;;MAEFC,SAAS;QAACR;QAAmBC;QAAgBE;;IAC/C;EACF;AACF;;;;;;AanIA,SAASW,eAAAA,oBAAmB;AA6BrB,IAAMC,UAAU,wBACrBC,MACAC,MAAe,UAAK;AAGpB,MAAIC;AAEJ,MAAI,CAACC,MAAMC,QAAQJ,IAAAA,KAAS,OAAOA,SAAS,UAAU;AAEpDE,kBAAc;MACZG,OAAO;QAACL;;MACRC;IACF;EACF,WAAWE,MAAMC,QAAQJ,IAAAA,KAASA,KAAKM,KAAK,CAACN,UAAS,OAAOA,UAAS,QAAA,GAAW;AAE/EE,kBAAc;MACZG,OAAOL;MACPC;IACF;EACF,OAAO;AACL,UAAM,IAAIM,MAAM,gCAAgCC,KAAKC,UAAUT,IAAAA,CAAAA;EACjE;AAEA,SAAOU,aAAYC,WAAWT,WAAAA;AAChC,GAxBuB;","names":["Module","APP_FILTER","APP_GUARD","Reflector","Injectable","Logger","HttpStatus","Inject","Module","APP_GUARD","Reflector","Injectable","SetMetadata","AUTHNPAAS_MODULE_OPTIONS","Symbol","NEED_LOGIN_KEY","AuthNPaasGuard","reflector","canActivate","context","http","switchToHttp","request","getRequest","response","getResponse","userId","loginUrl","userContext","needLoginMeta","getAllAndOverride","getHandler","getClass","redirect","AuthNPaasModule","forRoot","options","module","global","controllers","providers","provide","useValue","Reflector","APP_GUARD","useClass","exports","IS_PUBLIC_KEY","Public","__name","SetMetadata","ANONYMOUS_USER_ID","PERMISSION_API_CONFIG_TOKEN","Symbol","CACHE_CONFIG_TOKEN","AUTHZPAAS_MODULE_OPTIONS","ROLES_KEY","PERMISSIONS_KEY","ENVIRONMENT_KEY","NEED_LOGIN_KEY","DEFAULT_LOGIN_PATH","MOCK_ROLES_COOKIE_KEY","ENABLE_MOCK_ROLE_KEY","Injectable","AbilityBuilder","PureAbility","ROLE_SUBJECT","AbilityFactory","createForUser","permissionData","can","build","AbilityBuilder","PureAbility","role","roles","HttpException","PermissionDeniedType","PermissionDeniedException","HttpException","type","details","httpStatusCode","statusCode","cause","message","requiredRoles","requiredPermissions","environmentRequirement","metadata","name","unauthenticated","roleRequired","and","join","permissionRequired","or","customMessage","length","perm","subject","actions","map","PermissionService","logger","Logger","name","apiConfig","abilityFactory","getUserPermissions","requestDto","requestPromise","userId","ANONYMOUS_USER_ID","permissionData","fetchFromApi","dataWithTimestamp","fetchedAt","Date","error","timeout","baseUrl","appId","cookies","csrfToken","url","requestHeaders","cookieString","Object","entries","map","key","value","join","Cookie","controller","AbortController","timeoutId","setTimeout","abort","response","fetch","method","headers","signal","clearTimeout","ok","Error","status","statusText","PermissionDeniedException","cause","type","PermissionDeniedType","PERMISSION_CONFIG_QUERY_FAILED","message","HttpStatus","INTERNAL_SERVER_ERROR","data","json","roles","role_list","err","checkRoles","requirement","userContext","BAD_REQUEST","ability","createForUser","and","checkResults","role","can","ROLE_SUBJECT","hasRole","every","result","some","userRoles","warn","roleRequired","Injectable","Reflector","AuthZPaasGuard","reflector","permissionService","canActivate","context","http","switchToHttp","request","getRequest","userContext","checkRoleRequirement","getAllAndOverride","ROLES_KEY","getHandler","getClass","requirement","checkRoles","Injectable","Logger","RolesMiddleware","logger","Logger","name","permissionService","use","req","_res","next","baseUrl","protocol","get","userId","userContext","appId","cookies","csrfToken","headers","debug","permissionData","getUserPermissions","roles","userRoles","join","error","warn","Error","message","Catch","AuthZPaasExceptionFilter","catch","exception","host","ctx","switchToHttp","response","getResponse","status","getStatus","exceptionResponse","errorResponse","statusCode","timestamp","Date","toISOString","cause","type","message","details","requiredRoles","requiredPermissions","metadata","json","AuthZPaasModule","forRoot","options","permissionApi","module","global","controllers","providers","provide","AUTHZPAAS_MODULE_OPTIONS","useValue","PERMISSION_API_CONFIG_TOKEN","Reflector","PermissionService","AbilityFactory","AuthZPaasGuard","RolesMiddleware","APP_GUARD","useClass","APP_FILTER","AuthZPaasExceptionFilter","exports","forRootAsync","imports","inject","useFactory","moduleOptions","SetMetadata","CanRole","role","and","requirement","Array","isArray","roles","some","Error","JSON","stringify","SetMetadata","ROLES_KEY"]}
+{"version":3,"sources":["../src/authzpaas.module.ts","../src/services/permission.service.ts","../../nestjs-authnpaas/src/authnpaas.module.ts","../../nestjs-authnpaas/src/const.ts","../../nestjs-authnpaas/src/guards/authnpaas.guard.ts","../../nestjs-authnpaas/src/decorators/public.decorator.ts","../../nestjs-authnpaas/src/decorators/need-login.decorator.ts","../src/const.ts","../src/casl/ability.factory.ts","../src/exceptions/permission-denied.exception.ts","../src/guards/authzpaas.guard.ts","../src/decorators/can-role.decorator.ts"],"sourcesContent":["import { DynamicModule, Module, Type } from '@nestjs/common';\nimport { APP_GUARD, Reflector } from '@nestjs/core';\n\nimport { PermissionService } from './services/permission.service';\nimport { AbilityFactory } from './casl/ability.factory';\nimport { AuthZPaasGuard } from './guards/authzpaas.guard';\nimport { AuthZPaasModuleOptions } from './types';\nimport { AUTHZPAAS_MODULE_OPTIONS, PERMISSION_API_CONFIG_TOKEN } from './const';\n\nexport interface AuthZPaasModuleAsyncOptions {\n  imports?: Type<unknown>[];\n  inject?: (string | symbol | Type<unknown>)[];\n  useFactory: (\n    ...args: unknown[]\n  ) => Promise<AuthZPaasModuleOptions> | AuthZPaasModuleOptions;\n}\n\n@Module({})\nexport class AuthZPaasModule {\n  static forRoot(options?: AuthZPaasModuleOptions): DynamicModule {\n    const { permissionApi = {} } = options || {};\n    return {\n      module: AuthZPaasModule,\n      global: true,\n      controllers: [],\n      providers: [\n        // 配置提供者\n        {\n          provide: AUTHZPAAS_MODULE_OPTIONS,\n          useValue: { ...options },\n        },\n        {\n          provide: PERMISSION_API_CONFIG_TOKEN,\n          useValue: permissionApi,\n        },\n        // 核心服务\n        Reflector,\n        // 服务提供者\n        PermissionService,\n        AbilityFactory,\n        AuthZPaasGuard,\n        // 守卫提供者\n        {\n          provide: APP_GUARD,\n          useClass: AuthZPaasGuard,\n        },\n      ],\n      exports: [PermissionService, AbilityFactory],\n    };\n  }\n\n  /**\n   * 异步注册 AuthZPaas 模块（根模块）\n   * 用于需要从配置服务获取设置的场景\n   *\n   * @param options 异步配置选项\n   * @returns 动态模块\n   *\n   * @example\n   * ```typescript\n   * @Module({\n   *   imports: [\n   *     AuthZPaasModule.forRootAsync({\n   *       imports: [ConfigModule],\n   *       inject: [ConfigService],\n   *       useFactory: async (configService: ConfigService) => ({\n   *         permissionApi: {\n   *           baseUrl: configService.get('PERMISSION_API_URL'),\n   *           apiToken: configService.get('PERMISSION_API_TOKEN'),\n   *         },\n   *         cache: {\n   *           ttl: configService.get('CACHE_TTL', 300),\n   *           max: configService.get('CACHE_MAX', 1000),\n   *         },\n   *       }),\n   *     }),\n   *   ],\n   * })\n   * export class AppModule {}\n   * ```\n   */\n  static forRootAsync(options: AuthZPaasModuleAsyncOptions): DynamicModule {\n    const { imports = [], inject = [], useFactory } = options;\n\n    return {\n      module: AuthZPaasModule,\n      global: true,\n      imports,\n      controllers: [],\n      providers: [\n        // 异步配置提供者\n        {\n          provide: AUTHZPAAS_MODULE_OPTIONS,\n          useFactory,\n          inject,\n        },\n        // 权限 API 配置提供者\n        {\n          provide: PERMISSION_API_CONFIG_TOKEN,\n          useFactory: (moduleOptions: AuthZPaasModuleOptions) => {\n            return moduleOptions.permissionApi;\n          },\n          inject: [AUTHZPAAS_MODULE_OPTIONS],\n        },\n        // 核心服务\n        Reflector,\n        // 服务提供者\n        PermissionService,\n        AbilityFactory,\n        AuthZPaasGuard,\n        // 守卫提供者\n        {\n          provide: APP_GUARD,\n          useClass: AuthZPaasGuard,\n        },\n      ],\n      exports: [PermissionService, AbilityFactory],\n    };\n  }\n}\n","import { Injectable, Logger, HttpStatus, Inject } from '@nestjs/common';\nimport { Public } from '@lark-apaas/nestjs-authnpaas';\n\nimport type {\n  UserPermissionData,\n  UserRolesDTO,\n  UserContext,\n  PermissionApiConfig,\n} from '../types';\nimport { ANONYMOUS_USER_ID, PERMISSION_API_CONFIG_TOKEN } from '../const';\nimport { AbilityFactory, ROLE_SUBJECT } from '../casl/ability.factory';\nimport {\n  PermissionDeniedException,\n  PermissionDeniedType,\n} from '../exceptions/permission-denied.exception';\nimport type { RoleRequirement } from '../decorators';\n\n/**\n * 权限服务\n * 内置权限获取和缓存逻辑，以及权限检查逻辑\n */\n@Injectable()\n@Public() // 跳过 Guard 的鉴权检查，避免循环调用\nexport class PermissionService {\n  private readonly logger = new Logger(PermissionService.name);\n\n  constructor(\n    @Inject(PERMISSION_API_CONFIG_TOKEN)\n    private readonly apiConfig: PermissionApiConfig,\n    private readonly abilityFactory: AbilityFactory\n  ) {}\n\n  /**\n   * 获取用户权限数据\n   */\n  async getUserPermissions(\n    requestDto: UserRolesDTO\n  ): Promise<UserPermissionData | null> {\n    // 创建新的请求 Promise\n    const requestPromise = (async () => {\n      const userId = requestDto.userId || ANONYMOUS_USER_ID;\n      try {\n        const permissionData = await this.fetchFromApi(requestDto);\n        // 添加获取时间\n        const dataWithTimestamp: UserPermissionData = {\n          ...permissionData,\n          fetchedAt: new Date(),\n        };\n\n        return dataWithTimestamp;\n      } catch (error) {\n        this.logger.error(\n          `Failed to fetch permissions for user ${userId}:`,\n          error\n        );\n        throw error;\n      }\n    })();\n\n    return requestPromise;\n  }\n\n  /**\n   * 从 API 获取权限数据\n   * 内置实现，用户无需配置\n   */\n  private async fetchFromApi(\n    requestDto: UserRolesDTO\n  ): Promise<UserPermissionData> {\n    const { timeout = 5000 } = this.apiConfig || {};\n    const { baseUrl, userId, appId, cookie, csrfToken } = requestDto;\n\n    // 构建完整获取用户权限 URL\n    const url = `${baseUrl}/spark/app/${appId}/runtime/api/v1/permissions/roles`;\n\n    // 构建请求头\n    const requestHeaders: Record<string, string> = {\n      'Content-Type': 'application/json',\n    };\n\n    if (cookie) {\n      requestHeaders.Cookie = cookie;\n    }\n\n    if (csrfToken) {\n      requestHeaders['X-Suda-Csrf-Token'] = csrfToken;\n    }\n\n    // 发起请求（带超时控制）\n    const controller = new AbortController();\n    const timeoutId = setTimeout(() => controller.abort(), timeout);\n\n    try {\n      const response = await fetch(url, {\n        method: 'POST',\n        credentials: 'include',\n        headers: requestHeaders,\n        signal: controller.signal,\n      });\n\n      clearTimeout(timeoutId);\n\n      if (!response.ok) {\n        const error = new Error(\n          `Permission API returned ${response.status}: ${response.statusText}`\n        );\n        throw new PermissionDeniedException(\n          {\n            cause: error,\n            type: PermissionDeniedType.PERMISSION_CONFIG_QUERY_FAILED,\n            message: error.message,\n          },\n          HttpStatus.INTERNAL_SERVER_ERROR\n        );\n      }\n\n      const data = (await response.json()) as {\n        data?: { roleList?: string[] };\n      };\n\n      return {\n        userId,\n        roles: data.data?.roleList || [],\n        // TODO: 基于权限点位设置能力\n        // permissions: data.permissions || [],\n        fetchedAt: new Date(),\n      };\n    } catch (error: unknown) {\n      console.log('error', error);\n      clearTimeout(timeoutId);\n      let err = error as Error;\n\n      if ((error as { name?: string }).name === 'AbortError') {\n        err = new Error(`Permission API request timeout after ${timeout}ms`);\n      }\n\n      throw new PermissionDeniedException(\n        {\n          cause: err,\n          type: PermissionDeniedType.PERMISSION_CONFIG_QUERY_FAILED,\n          message: err.message,\n        },\n        HttpStatus.INTERNAL_SERVER_ERROR\n      );\n    }\n  }\n\n  // /**\n  //  * 获取用户的 Ability 实例（带缓存）\n  //  * @param userId 用户ID\n  //  * @returns CASL Ability 实例\n  //  */\n  // private async getUserAbility(\n  //   userId?: string,\n  //   mockRoles?: string[]\n  // ): Promise<AppAbility> {\n  //   // 计算缓存 key\n  //   const key = this.buildCacheKey(userId, mockRoles);\n\n  //   // 尝试从缓存获取\n  //   const cached = this.cache.get(key);\n  //   if (cached) {\n  //     return cached.ability;\n  //   }\n\n  //   // 缓存未命中，调用 getUserPermissions 会创建并缓存\n  //   await this.getUserPermissions(userId, mockRoles);\n\n  //   // 再次从缓存获取（此时一定存在）\n  //   const newCached = this.cache.get(key);\n  //   return newCached!.ability;\n  // }\n\n  /**\n   * 检查角色要求\n   * 使用 CASL Ability 统一鉴权方式\n   * @param requirement 角色要求\n   * @param userId 用户ID,匿名用户时为空\n   * @returns 用户权限数据\n   * @throws PermissionDeniedException 当角色不满足时\n   */\n  async checkRoles(\n    requirement: RoleRequirement,\n    userContext?: UserContext,\n    cookie?: string,\n    csrfToken?: string\n  ): Promise<UserPermissionData> {\n    const userId = userContext?.userId || ANONYMOUS_USER_ID;\n    if (!csrfToken) {\n      throw new PermissionDeniedException(\n        {\n          cause: new Error('CSRF token is required'),\n          type: PermissionDeniedType.PERMISSION_CONFIG_QUERY_FAILED,\n          message: 'CSRF token is required',\n        },\n        HttpStatus.BAD_REQUEST\n      );\n    }\n\n    const permissionData = await this.getUserPermissions({\n      // FIXME: 使用 request 的 base url\n      baseUrl: userContext?.baseUrl || '',\n      userId,\n      appId: userContext?.appId || '',\n      csrfToken,\n      cookie,\n    });\n\n    if (!permissionData) {\n      throw new PermissionDeniedException(\n        {\n          cause: new Error('Permission data fetch api is not configured'),\n          type: PermissionDeniedType.PERMISSION_CONFIG_QUERY_FAILED,\n          message: 'Permission data fetch api is not configured',\n        },\n        HttpStatus.BAD_REQUEST\n      );\n    }\n\n    // 创建 Ability 实例\n    const ability = this.abilityFactory.createForUser(permissionData);\n\n    const { roles, and } = requirement;\n\n    // 使用 CASL 统一检查角色权限\n    // 角色作为 action，'@role' 作为 subject\n    const checkResults = roles.map(role => ability.can(role, ROLE_SUBJECT));\n\n    const hasRole = and\n      ? checkResults.every(result => result)\n      : checkResults.some(result => result);\n\n    if (!hasRole) {\n      const userRoles = permissionData.roles;\n      this.logger.warn(\n        `角色检查失败: 用户 ${userId}, 用户角色 [${userRoles.join(', ')}], 需要 [${roles.join(', ')}]`\n      );\n      throw PermissionDeniedException.roleRequired(roles, and);\n    }\n\n    return permissionData;\n  }\n\n  // /**\n  //  * 检查权限要求\n  //  * @param requirements 权限要求列表\n  //  * @param userId 用户ID\n  //  * @returns 用户权限数据\n  //  * @throws PermissionDeniedException 当权限不满足时\n  //  */\n  // async checkPermissions(\n  //   params: CheckPermissionsParams,\n  //   userId?: string,\n  //   mockRoles?: string[]\n  // ): Promise<UserPermissionData> {\n  //   // 获取权限数据（用于返回）\n  //   const permissionData = await this.getUserPermissions(userId, mockRoles);\n  //   if (!permissionData) {\n  //     throw new PermissionDeniedException(\n  //       {\n  //         cause: new Error('Permission data fetch api is not configured'),\n  //         type: PermissionDeniedType.PERMISSION_CONFIG_QUERY_FAILED,\n  //         message: 'Permission data fetch api is not configured',\n  //       },\n  //       HttpStatus.BAD_REQUEST\n  //     );\n  //   }\n  //   const { requirements, or } = params;\n  //   if (!requirements || requirements.length === 0) {\n  //     return permissionData;\n  //   }\n\n  //   // 获取缓存的 Ability 实例\n  //   const ability = await this.getUserAbility(userId, mockRoles);\n\n  //   // 收集所有失败的权限要求\n  //   const failedRequirements: Array<{\n  //     actions: string[];\n  //     subject: string;\n  //     or: boolean;\n  //   }> = [];\n\n  //   // 检查每个权限要求\n  //   for (const requirement of requirements) {\n  //     const { actions, subject, or = false } = requirement;\n\n  //     // 使用缓存的 Ability 实例检查权限\n  //     const checkResults = actions.map(action => ability.can(action, subject));\n\n  //     // 根据 or 决定是 AND 还是 OR 逻辑\n  //     const hasPermission = or\n  //       ? checkResults.some(result => result)\n  //       : checkResults.every(result => result);\n\n  //     if (!hasPermission) {\n  //       failedRequirements.push({\n  //         actions,\n  //         subject: String(subject),\n  //         or,\n  //       });\n  //     }\n  //   }\n\n  //   // 如果有失败的权限要求，抛出异常\n  //   if (failedRequirements.length > 0) {\n  //     if (or && failedRequirements.length === requirements.length) {\n  //       throw PermissionDeniedException.permissionRequired(\n  //         failedRequirements.map(({ actions, subject }) => ({\n  //           actions,\n  //           subject: String(subject),\n  //         })),\n  //         true\n  //       );\n  //     } else if (!or) {\n  //       throw PermissionDeniedException.permissionRequired(\n  //         failedRequirements.map(({ actions, subject }) => ({\n  //           actions,\n  //           subject: String(subject),\n  //         })),\n  //         false\n  //       );\n  //     }\n  //   }\n  //   return permissionData;\n  // }\n}\n","import { DynamicModule, Module } from '@nestjs/common';\nimport { APP_GUARD, Reflector } from '@nestjs/core';\nimport { AuthNPaasModuleOptions } from './types';\nimport { AUTHNPAAS_MODULE_OPTIONS } from './const';\nimport { AuthNPaasGuard } from './guards/authnpaas.guard';\n\n@Module({})\nexport class AuthNPaasModule {\n  static forRoot(options?: AuthNPaasModuleOptions): DynamicModule {\n    return {\n      module: AuthNPaasModule,\n      global: true,\n      controllers: [],\n      providers: [\n        // 配置提供者\n        {\n          provide: AUTHNPAAS_MODULE_OPTIONS,\n          useValue: {\n            ...(options || {}),\n          },\n        },\n        // 核心服务\n        Reflector,\n        // 服务提供者\n        AuthNPaasGuard,\n        // 守卫提供者\n        {\n          provide: APP_GUARD,\n          useClass: AuthNPaasGuard,\n        },\n      ],\n      exports: [],\n    };\n  }\n}\n","/**\n * 常量\n */\n\n/** AuthNPaas 模块选项 Token */\nexport const AUTHNPAAS_MODULE_OPTIONS = Symbol('AUTHNPAAS_MODULE_OPTIONS');\n\n/**\n * 元数据键\n */\n\n/** 需要登录元数据键 */\nexport const NEED_LOGIN_KEY = 'authnpaas:needLogin';\n","import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';\nimport { Response } from 'express';\nimport { Reflector } from '@nestjs/core';\nimport { NEED_LOGIN_KEY } from '../const';\n\n/**\n * AuthNPaas 守卫\n * 负责协调所有鉴权检查，具体检查逻辑委托给 PermissionService\n */\n@Injectable()\nexport class AuthNPaasGuard implements CanActivate {\n  constructor(private reflector: Reflector) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const http = context.switchToHttp();\n    const request = http.getRequest();\n    const response = http.getResponse<Response>();\n\n    const { userId, loginUrl } = request.userContext || {};\n\n    // 读取 NeedLogin 元数据并标记到请求对象，供异常过滤器使用\n    const needLoginMeta = this.reflector.getAllAndOverride<{\n      loginPath?: string;\n    }>(NEED_LOGIN_KEY, [context.getHandler(), context.getClass()]);\n\n    // NeedLogin 且无 userId -> 在守卫内直接重定向并拦截\n    if (needLoginMeta && !userId && loginUrl) {\n      response.redirect(302, loginUrl);\n      return false;\n    }\n\n    return true;\n  }\n}\n","import { SetMetadata } from '@nestjs/common';\n\n/**\n * Public 装饰器的元数据键\n */\nexport const IS_PUBLIC_KEY = 'isPublic';\n\n/**\n * 标记接口为公开接口，跳过 AuthNPaasGuard 的鉴权检查\n * \n * @example\n * ```typescript\n * @Controller('mock-api/users')\n * @Public()  // 控制器级别\n * export class MockPermissionController {\n *   @Get(':userId/permissions')\n *   getUserPermissions() {}\n * }\n * \n * // 或者在方法级别\n * @Controller('api')\n * export class ApiController {\n *   @Get('public-info')\n *   @Public()  // 方法级别\n *   getPublicInfo() {}\n * }\n * ```\n */\nexport const Public = () => SetMetadata(IS_PUBLIC_KEY, true);\n\n","import { SetMetadata } from '@nestjs/common';\nimport { NEED_LOGIN_KEY } from '../const';\n\n/**\n * NeedLogin 装饰器\n * 标记接口需要登录。如果鉴权失败（如 401/403），异常过滤器会将请求重定向到登录页。\n * 可选地传入登录页路径，默认 '/login'。\n */\nexport const NeedLogin = (loginPath?: string): MethodDecorator & ClassDecorator => {\n  return SetMetadata(NEED_LOGIN_KEY, { loginPath });\n};\n\n\n","/**\n * 常量\n */\n\n/** 匿名用户 ID */\nexport const ANONYMOUS_USER_ID = 'anonymous_user_id';\n\n/**\n * 依赖注入 Token\n */\n\n/** 权限 API 配置 Token */\nexport const PERMISSION_API_CONFIG_TOKEN = Symbol('PERMISSION_API_CONFIG');\n\n/** AuthZPaas 模块选项 Token */\nexport const AUTHZPAAS_MODULE_OPTIONS = Symbol('AUTHZPAAS_MODULE_OPTIONS');\n\n/**\n * 元数据键\n */\n\n/** 需要的角色元数据键 */\nexport const ROLES_KEY = 'authzpaas:roles';\n\n/** 需要的权限元数据键 */\n// export const PERMISSIONS_KEY = 'authzpaas:permissions';\n","import { Injectable } from '@nestjs/common';\nimport { AbilityBuilder, PureAbility, AbilityClass } from '@casl/ability';\nimport { UserPermissionData, Action, Subject } from '../types';\n\n/**\n * CASL Ability 类型\n */\nexport type AppAbility = PureAbility<[Action, Subject]>;\n\n/**\n * 角色检查的特殊 Subject\n * 用于统一角色鉴权和权限点位鉴权\n * \n * 使用方式：\n * - 权限点位鉴权：ability.can('read', 'Todo')\n * - 角色鉴权：ability.can('admin', ROLE_SUBJECT) 或 ability.can('admin', '@role')\n */\nexport const ROLE_SUBJECT = '@role';\n\n/**\n * Ability 工厂\n * 负责根据用户权限数据创建 CASL Ability 实例\n * \n * 统一了两种鉴权方式：\n * 1. 基于角色的鉴权 - 角色名作为 action，'@role' 作为 subject\n * 2. 基于权限点位的鉴权 - 标准的 action + subject 模式\n */\n@Injectable()\nexport class AbilityFactory {\n  /**\n   * 为用户创建 Ability\n   */\n  createForUser(permissionData: UserPermissionData): AppAbility {\n    const { can, build } = new AbilityBuilder<AppAbility>(\n      PureAbility as AbilityClass<AppAbility>,\n    );\n\n    // TODO: 基于权限点位设置能力\n    // for (const permission of permissionData.permissions) {\n    //   const { sub, actions } = permission;\n      \n    //   // 为每个 action 添加权限\n    //   for (const action of actions) {\n    //     can(action as Action, sub);\n    //   }\n    // }\n\n    // 基于角色设置能力\n    for (const role of permissionData.roles) {\n      can(role as Action, ROLE_SUBJECT);\n    }\n\n    return build();\n  }\n}\n","import { HttpException } from '@nestjs/common';\n\n/**\n * 权限拒绝异常类型\n */\nexport enum PermissionDeniedType {\n  /** 用户未认证 */\n  UNAUTHENTICATED = 'UNAUTHENTICATED',\n  /** 缺少角色 */\n  ROLE_REQUIRED = 'ROLE_REQUIRED',\n  /** 缺少权限 */\n  PERMISSION_REQUIRED = 'PERMISSION_REQUIRED',\n  /** 权限配置查询失败 */\n  PERMISSION_CONFIG_QUERY_FAILED = 'PERMISSION_CONFIG_QUERY_FAILED',\n}\n\n/**\n * 权限拒绝异常详情\n */\nexport interface PermissionDeniedDetails {\n  /** 错误堆栈 */\n  cause?: Error;\n  /** 异常类型 */\n  type: PermissionDeniedType;\n  /** 错误消息 */\n  message: string;\n  /** 需要的角色（如果适用） */\n  requiredRoles?: string[];\n  /** 需要的权限（如果适用） */\n  requiredPermissions?: Array<{\n    actions: string[];\n    subject: string;\n  }>;\n  /** 环境要求（如果适用） */\n  environmentRequirement?: string;\n  /** 额外信息 */\n  metadata?: Record<string, unknown>;\n}\n\n/**\n * 权限拒绝异常\n * 专门用于 AuthZPaas 模块的权限检查失败场景\n */\nexport class PermissionDeniedException extends HttpException {\n  public readonly type: PermissionDeniedType;\n  public readonly details: PermissionDeniedDetails;\n\n  constructor(details: PermissionDeniedDetails, httpStatusCode: number = 403) {\n    super(\n      {\n        statusCode: httpStatusCode,\n        cause: details.cause,\n        type: details.type,\n        message: details.message,\n        ...(details.requiredRoles && { requiredRoles: details.requiredRoles }),\n        ...(details.requiredPermissions && {\n          requiredPermissions: details.requiredPermissions,\n        }),\n        ...(details.environmentRequirement && {\n          environmentRequirement: details.environmentRequirement,\n        }),\n        ...(details.metadata && { metadata: details.metadata }),\n      },\n      httpStatusCode\n    );\n\n    this.type = details.type;\n    this.details = details;\n    this.name = 'PermissionDeniedException';\n  }\n\n  /**\n   * 创建用户未认证异常\n   */\n  static unauthenticated(\n    message: string = '用户未认证'\n  ): PermissionDeniedException {\n    return new PermissionDeniedException({\n      type: PermissionDeniedType.UNAUTHENTICATED,\n      message,\n    });\n  }\n\n  /**\n   * 创建角色不足异常\n   */\n  static roleRequired(\n    requiredRoles: string[],\n    and: boolean = false\n  ): PermissionDeniedException {\n    const message = and\n      ? `需要所有角色: ${requiredRoles.join(', ')}`\n      : `需要以下任一角色: ${requiredRoles.join(', ')}`;\n\n    return new PermissionDeniedException({\n      type: PermissionDeniedType.ROLE_REQUIRED,\n      message,\n      requiredRoles,\n      metadata: { and },\n    });\n  }\n\n  /**\n   * 创建权限不足异常\n   */\n  static permissionRequired(\n    requiredPermissions: Array<{ actions: string[]; subject: string }>,\n    or: boolean = false,\n    customMessage?: string\n  ): PermissionDeniedException {\n    let message: string;\n\n    if (customMessage) {\n      message = customMessage;\n    } else if (requiredPermissions.length === 1) {\n      const perm = requiredPermissions[0];\n      message = or\n        ? `缺少权限: 需要对 ${perm.subject} 执行以下任一操作 [${perm.actions.join(', ')}]`\n        : `缺少权限: 需要对 ${perm.subject} 执行所有操作 [${perm.actions.join(', ')}]`;\n    } else {\n      message = or\n        ? `缺少权限: 需要满足以下任一权限要求: ${requiredPermissions.map(({ actions, subject }) => `对 ${subject} 执行以下任一操作 [${actions.join(', ')}]`).join(', ')}`\n        : `缺少权限: 需要满足以下所有权限要求: ${requiredPermissions.map(({ actions, subject }) => `对 ${subject} 执行所有操作 [${actions.join(', ')}]`).join(', ')}`;\n    }\n\n    return new PermissionDeniedException({\n      type: PermissionDeniedType.PERMISSION_REQUIRED,\n      message,\n      requiredPermissions,\n      metadata: { or },\n    });\n  }\n}\n","import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\nimport { PermissionService } from '../services/permission.service';\nimport { ROLES_KEY } from '../const';\nimport { CheckRoleRequirement } from '../decorators';\nimport { UserContext } from '../types';\n\n/**\n * AuthZPaas 守卫\n * 负责协调所有鉴权检查，具体检查逻辑委托给 PermissionService\n */\n@Injectable()\nexport class AuthZPaasGuard implements CanActivate {\n  constructor(\n    private reflector: Reflector,\n    private permissionService: PermissionService\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const http = context.switchToHttp();\n    const request = http.getRequest();\n    const cookie = request.headers.cookie as string;\n    const csrfToken = request.csrfToken as string;\n\n    // FIXME: use new api to get base url\n    const baseUrl = `${request.protocol}://${request.get('host')}`;\n\n    const userContext = request.userContext as UserContext;\n    userContext.baseUrl = baseUrl;\n\n    // 检查角色要求\n    const checkRoleRequirement =\n      this.reflector.getAllAndOverride<CheckRoleRequirement>(ROLES_KEY, [\n        context.getHandler(),\n        context.getClass(),\n      ]);\n\n    if (checkRoleRequirement) {\n      // 检查角色要求\n      await this.permissionService.checkRoles(\n        checkRoleRequirement,\n        userContext,\n        cookie,\n        csrfToken\n      );\n    }\n\n    // // 检查权限要求\n    // const checkPermissionParams =\n    //   this.reflector.getAllAndOverride<CheckPermissionsParams>(\n    //     PERMISSIONS_KEY,\n    //     [context.getHandler(), context.getClass()]\n    //   );\n\n    // if (checkPermissionParams) {\n    //   await this.checkPermissionRequirement(\n    //     checkPermissionParams,\n    //     userId,\n    //     mockRoles\n    //   );\n    // }\n\n    return true;\n  }\n\n  // /**\n  //  * 检查权限要求\n  //  */\n  // private async checkPermissionRequirement(\n  //   params: CheckPermissionsParams,\n  //   userId?: string,\n  //   mockRoles?: string[]\n  // ) {\n  //   return this.permissionService.checkPermissions(params, userId, mockRoles);\n  // }\n}\n","import { SetMetadata } from '@nestjs/common';\nimport { ROLES_KEY } from '../const';\n\n/**\n * 角色要求配置\n */\nexport interface RoleRequirement {\n  /** 需要的角色列表 */\n  roles: string[];\n  /** 是否需要所有角色（AND），默认 false（OR） */\n  and?: boolean;\n}\n\nexport type CheckRoleRequirement = RoleRequirement;\n\n/**\n * 要求用户拥有指定角色\n * \n * @example\n * ```typescript\n * // 需要任一角色\n * @CanRole(['admin', 'moderator'])\n * async deleteUser() {}\n * \n * // 需要所有角色\n * @CanRole(['admin', 'superuser'], true)\n * async criticalOperation() {}\n * ```\n */\nexport const CanRole = (\n  role: string[] | string,\n  and: boolean = false,\n): MethodDecorator => {\n  // 解析参数\n  let requirement: RoleRequirement;\n\n  if (!Array.isArray(role) && typeof role === 'string') {\n    // 对象形式\n    requirement = {\n      roles: [role],\n      and: and,\n    };\n  } else if (Array.isArray(role) && role.some((role) => typeof role === 'string')) {\n    // 字符串列表形式\n    requirement = {\n      roles: role as string[],\n      and: and,\n    };\n  } else {\n    throw new Error('Invalid CanRole parameter: ' + JSON.stringify(role));\n  }\n\n  return SetMetadata(ROLES_KEY, requirement);\n};\n"],"mappings":";;;;AAAA,SAAwBA,UAAAA,eAAoB;AAC5C,SAASC,aAAAA,YAAWC,aAAAA,kBAAiB;;;ACDrC,SAASC,cAAAA,aAAYC,QAAQC,YAAYC,cAAc;;;ACAvD,SAAwBC,cAAc;AACtC,SAASC,WAAWC,aAAAA,kBAAiB;AEDrC,SAASC,kBAAiD;AAE1D,SAASD,iBAAiB;ACF1B,SAASE,mBAAmB;ACA5B,SAASA,eAAAA,oBAAmB;;;;;;AHKrB,IAAMC,2BAA2BC,OAAO,0BAAA;AAOxC,IAAMC,iBAAiB;;;;;;;;;;;;;;ACFvB,IAAMC,iBAAN,MAAMA;SAAAA;;;SAAAA;;;;EACX,YAAoBC,WAAsB;SAAtBA,YAAAA;EAAuB;EAE3C,MAAMC,YAAYC,SAA6C;AAC7D,UAAMC,OAAOD,QAAQE,aAAY;AACjC,UAAMC,UAAUF,KAAKG,WAAU;AAC/B,UAAMC,WAAWJ,KAAKK,YAAW;AAEjC,UAAM,EAAEC,QAAQC,SAAQ,IAAKL,QAAQM,eAAe,CAAC;AAGrD,UAAMC,gBAAgB,KAAKZ,UAAUa,kBAElCf,gBAAgB;MAACI,QAAQY,WAAU;MAAIZ,QAAQa,SAAQ;KAAG;AAG7D,QAAIH,iBAAiB,CAACH,UAAUC,UAAU;AACxCH,eAASS,SAAS,KAAKN,QAAAA;AACvB,aAAO;IACT;AAEA,WAAO;EACT;AACF;;;;;;;;;;;;;;;;AF1BO,IAAMO,kBAAN,MAAMA,iBAAAA;SAAAA;;;SAAAA;;;EACX,OAAOC,QAAQC,SAAiD;AAC9D,WAAO;MACLC,QAAQH;MACRI,QAAQ;MACRC,aAAa,CAAA;MACbC,WAAW;;QAET;UACEC,SAAS5B;UACT6B,UAAU;YACR,GAAIN,WAAW,CAAC;UAClB;QACF;;QAEAO;;QAEA3B;;QAEA;UACEyB,SAASG;UACTC,UAAU7B;QACZ;;MAEF8B,SAAS,CAAA;IACX;EACF;AACF;;;;AG7BO,IAAMC,gBAAgB;AAuBtB,IAAMC,SAAS,gBAAAC,QAAA,MAAMC,YAAYH,eAAe,IAAA,GAAjC,QAAA;;;AEvBf,IAAMI,oBAAoB;AAO1B,IAAMC,8BAA8BC,OAAO,uBAAA;AAG3C,IAAMC,2BAA2BD,OAAO,0BAAA;AAOxC,IAAME,YAAY;;;ACtBzB,SAASC,cAAAA,mBAAkB;AAC3B,SAASC,gBAAgBC,mBAAiC;;;;;;;;AAgBnD,IAAMC,eAAe;AAWrB,IAAMC,iBAAN,MAAMA;SAAAA;;;;;;EAIXC,cAAcC,gBAAgD;AAC5D,UAAM,EAAEC,KAAKC,MAAK,IAAK,IAAIC,eACzBC,WAAAA;AAcF,eAAWC,QAAQL,eAAeM,OAAO;AACvCL,UAAII,MAAgBR,YAAAA;IACtB;AAEA,WAAOK,MAAAA;EACT;AACF;;;;;;ACtDA,SAASK,qBAAqB;AAKvB,IAAKC,uBAAAA,0BAAAA,uBAAAA;AACA,EAAAA,sBAAA,iBAAA,IAAA;AAED,EAAAA,sBAAA,eAAA,IAAA;AAEA,EAAAA,sBAAA,qBAAA,IAAA;AAEI,EAAAA,sBAAA,gCAAA,IAAA;SAPHA;;AAsCL,IAAMC,4BAAN,MAAMA,mCAAkCC,cAAAA;EA3C/C,OA2C+CA;;;EAC7BC;EACAC;EAEhB,YAAYA,SAAkCC,iBAAyB,KAAK;AAC1E,UACE;MACEC,YAAYD;MACZE,OAAOH,QAAQG;MACfJ,MAAMC,QAAQD;MACdK,SAASJ,QAAQI;MACjB,GAAIJ,QAAQK,iBAAiB;QAAEA,eAAeL,QAAQK;MAAc;MACpE,GAAIL,QAAQM,uBAAuB;QACjCA,qBAAqBN,QAAQM;MAC/B;MACA,GAAIN,QAAQO,0BAA0B;QACpCA,wBAAwBP,QAAQO;MAClC;MACA,GAAIP,QAAQQ,YAAY;QAAEA,UAAUR,QAAQQ;MAAS;IACvD,GACAP,cAAAA;AAGF,SAAKF,OAAOC,QAAQD;AACpB,SAAKC,UAAUA;AACf,SAAKS,OAAO;EACd;;;;EAKA,OAAOC,gBACLN,UAAkB,kCACS;AAC3B,WAAO,IAAIP,2BAA0B;MACnCE,MAAI;MACJK;IACF,CAAA;EACF;;;;EAKA,OAAOO,aACLN,eACAO,MAAe,OACY;AAC3B,UAAMR,UAAUQ,MACZ,yCAAWP,cAAcQ,KAAK,IAAA,CAAA,KAC9B,qDAAaR,cAAcQ,KAAK,IAAA,CAAA;AAEpC,WAAO,IAAIhB,2BAA0B;MACnCE,MAAI;MACJK;MACAC;MACAG,UAAU;QAAEI;MAAI;IAClB,CAAA;EACF;;;;EAKA,OAAOE,mBACLR,qBACAS,KAAc,OACdC,eAC2B;AAC3B,QAAIZ;AAEJ,QAAIY,eAAe;AACjBZ,gBAAUY;IACZ,WAAWV,oBAAoBW,WAAW,GAAG;AAC3C,YAAMC,OAAOZ,oBAAoB,CAAA;AACjCF,gBAAUW,KACN,gDAAaG,KAAKC,OAAO,sDAAcD,KAAKE,QAAQP,KAAK,IAAA,CAAA,MACzD,gDAAaK,KAAKC,OAAO,0CAAYD,KAAKE,QAAQP,KAAK,IAAA,CAAA;IAC7D,OAAO;AACLT,gBAAUW,KACN,uGAAuBT,oBAAoBe,IAAI,CAAC,EAAED,SAASD,QAAO,MAAO,UAAKA,OAAAA,sDAAqBC,QAAQP,KAAK,IAAA,CAAA,GAAQ,EAAEA,KAAK,IAAA,CAAA,KAC/H,uGAAuBP,oBAAoBe,IAAI,CAAC,EAAED,SAASD,QAAO,MAAO,UAAKA,OAAAA,0CAAmBC,QAAQP,KAAK,IAAA,CAAA,GAAQ,EAAEA,KAAK,IAAA,CAAA;IACnI;AAEA,WAAO,IAAIhB,2BAA0B;MACnCE,MAAI;MACJK;MACAE;MACAE,UAAU;QAAEO;MAAG;IACjB,CAAA;EACF;AACF;;;;;;;;;;;;;;;;;;;;AR7GO,IAAMO,oBAAN,MAAMA,mBAAAA;SAAAA;;;;;EACMC,SAAS,IAAIC,OAAOF,mBAAkBG,IAAI;EAE3D,YAEmBC,WACAC,gBACjB;SAFiBD,YAAAA;SACAC,iBAAAA;EAChB;;;;EAKH,MAAMC,mBACJC,YACoC;AAEpC,UAAMC,kBAAkB,YAAA;AACtB,YAAMC,SAASF,WAAWE,UAAUC;AACpC,UAAI;AACF,cAAMC,iBAAiB,MAAM,KAAKC,aAAaL,UAAAA;AAE/C,cAAMM,oBAAwC;UAC5C,GAAGF;UACHG,WAAW,oBAAIC,KAAAA;QACjB;AAEA,eAAOF;MACT,SAASG,OAAO;AACd,aAAKf,OAAOe,MACV,wCAAwCP,MAAAA,KACxCO,KAAAA;AAEF,cAAMA;MACR;IACF,GAAA;AAEA,WAAOR;EACT;;;;;EAMA,MAAcI,aACZL,YAC6B;AAC7B,UAAM,EAAEU,UAAU,IAAI,IAAK,KAAKb,aAAa,CAAC;AAC9C,UAAM,EAAEc,SAAST,QAAQU,OAAOC,QAAQC,UAAS,IAAKd;AAGtD,UAAMe,MAAM,GAAGJ,OAAAA,cAAqBC,KAAAA;AAGpC,UAAMI,iBAAyC;MAC7C,gBAAgB;IAClB;AAEA,QAAIH,QAAQ;AACVG,qBAAeC,SAASJ;IAC1B;AAEA,QAAIC,WAAW;AACbE,qBAAe,mBAAA,IAAuBF;IACxC;AAGA,UAAMI,aAAa,IAAIC,gBAAAA;AACvB,UAAMC,YAAYC,WAAW,MAAMH,WAAWI,MAAK,GAAIZ,OAAAA;AAEvD,QAAI;AACF,YAAMa,WAAW,MAAMC,MAAMT,KAAK;QAChCU,QAAQ;QACRC,aAAa;QACbC,SAASX;QACTY,QAAQV,WAAWU;MACrB,CAAA;AAEAC,mBAAaT,SAAAA;AAEb,UAAI,CAACG,SAASO,IAAI;AAChB,cAAMrB,QAAQ,IAAIsB,MAChB,2BAA2BR,SAASS,MAAM,KAAKT,SAASU,UAAU,EAAE;AAEtE,cAAM,IAAIC,0BACR;UACEC,OAAO1B;UACP2B,MAAMC,qBAAqBC;UAC3BC,SAAS9B,MAAM8B;QACjB,GACAC,WAAWC,qBAAqB;MAEpC;AAEA,YAAMC,OAAQ,MAAMnB,SAASoB,KAAI;AAIjC,aAAO;QACLzC;QACA0C,OAAOF,KAAKA,MAAMG,YAAY,CAAA;;;QAG9BtC,WAAW,oBAAIC,KAAAA;MACjB;IACF,SAASC,OAAgB;AACvBqC,cAAQC,IAAI,SAAStC,KAAAA;AACrBoB,mBAAaT,SAAAA;AACb,UAAI4B,MAAMvC;AAEV,UAAKA,MAA4Bb,SAAS,cAAc;AACtDoD,cAAM,IAAIjB,MAAM,wCAAwCrB,OAAAA,IAAW;MACrE;AAEA,YAAM,IAAIwB,0BACR;QACEC,OAAOa;QACPZ,MAAMC,qBAAqBC;QAC3BC,SAASS,IAAIT;MACf,GACAC,WAAWC,qBAAqB;IAEpC;EACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoCA,MAAMQ,WACJC,aACAC,aACAtC,QACAC,WAC6B;AAC7B,UAAMZ,SAASiD,aAAajD,UAAUC;AACtC,QAAI,CAACW,WAAW;AACd,YAAM,IAAIoB,0BACR;QACEC,OAAO,IAAIJ,MAAM,wBAAA;QACjBK,MAAMC,qBAAqBC;QAC3BC,SAAS;MACX,GACAC,WAAWY,WAAW;IAE1B;AAEA,UAAMhD,iBAAiB,MAAM,KAAKL,mBAAmB;;MAEnDY,SAASwC,aAAaxC,WAAW;MACjCT;MACAU,OAAOuC,aAAavC,SAAS;MAC7BE;MACAD;IACF,CAAA;AAEA,QAAI,CAACT,gBAAgB;AACnB,YAAM,IAAI8B,0BACR;QACEC,OAAO,IAAIJ,MAAM,6CAAA;QACjBK,MAAMC,qBAAqBC;QAC3BC,SAAS;MACX,GACAC,WAAWY,WAAW;IAE1B;AAGA,UAAMC,UAAU,KAAKvD,eAAewD,cAAclD,cAAAA;AAElD,UAAM,EAAEwC,OAAOW,IAAG,IAAKL;AAIvB,UAAMM,eAAeZ,MAAMa,IAAIC,CAAAA,SAAQL,QAAQM,IAAID,MAAME,YAAAA,CAAAA;AAEzD,UAAMC,UAAUN,MACZC,aAAaM,MAAMC,CAAAA,WAAUA,MAAAA,IAC7BP,aAAaQ,KAAKD,CAAAA,WAAUA,MAAAA;AAEhC,QAAI,CAACF,SAAS;AACZ,YAAMI,YAAY7D,eAAewC;AACjC,WAAKlD,OAAOwE,KACV,sDAAchE,MAAAA,+BAAiB+D,UAAUE,KAAK,IAAA,CAAA,oBAAevB,MAAMuB,KAAK,IAAA,CAAA,GAAQ;AAElF,YAAMjC,0BAA0BkC,aAAaxB,OAAOW,GAAAA;IACtD;AAEA,WAAOnD;EACT;AAoFF;;;;;;;;;;;;;ASrUA,SAASiE,cAAAA,mBAAiD;AAC1D,SAASC,aAAAA,kBAAiB;;;;;;;;;;;;AAWnB,IAAMC,iBAAN,MAAMA;SAAAA;;;;;EACX,YACUC,WACAC,mBACR;SAFQD,YAAAA;SACAC,oBAAAA;EACP;EAEH,MAAMC,YAAYC,SAA6C;AAC7D,UAAMC,OAAOD,QAAQE,aAAY;AACjC,UAAMC,UAAUF,KAAKG,WAAU;AAC/B,UAAMC,SAASF,QAAQG,QAAQD;AAC/B,UAAME,YAAYJ,QAAQI;AAG1B,UAAMC,UAAU,GAAGL,QAAQM,QAAQ,MAAMN,QAAQO,IAAI,MAAA,CAAA;AAErD,UAAMC,cAAcR,QAAQQ;AAC5BA,gBAAYH,UAAUA;AAGtB,UAAMI,uBACJ,KAAKf,UAAUgB,kBAAwCC,WAAW;MAChEd,QAAQe,WAAU;MAClBf,QAAQgB,SAAQ;KACjB;AAEH,QAAIJ,sBAAsB;AAExB,YAAM,KAAKd,kBAAkBmB,WAC3BL,sBACAD,aACAN,QACAE,SAAAA;IAEJ;AAiBA,WAAO;EACT;AAYF;;;;;;;;;;;;;;;;;;AVzDO,IAAMW,kBAAN,MAAMA,iBAAAA;SAAAA;;;EACX,OAAOC,QAAQC,SAAiD;AAC9D,UAAM,EAAEC,gBAAgB,CAAC,EAAC,IAAKD,WAAW,CAAC;AAC3C,WAAO;MACLE,QAAQJ;MACRK,QAAQ;MACRC,aAAa,CAAA;MACbC,WAAW;;QAET;UACEC,SAASC;UACTC,UAAU;YAAE,GAAGR;UAAQ;QACzB;QACA;UACEM,SAASG;UACTD,UAAUP;QACZ;;QAEAS;;QAEAC;QACAC;QACAC;;QAEA;UACEP,SAASQ;UACTC,UAAUF;QACZ;;MAEFG,SAAS;QAACL;QAAmBC;;IAC/B;EACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgCA,OAAOK,aAAajB,SAAqD;AACvE,UAAM,EAAEkB,UAAU,CAAA,GAAIC,SAAS,CAAA,GAAIC,WAAU,IAAKpB;AAElD,WAAO;MACLE,QAAQJ;MACRK,QAAQ;MACRe;MACAd,aAAa,CAAA;MACbC,WAAW;;QAET;UACEC,SAASC;UACTa;UACAD;QACF;;QAEA;UACEb,SAASG;UACTW,YAAY,wBAACC,kBAAAA;AACX,mBAAOA,cAAcpB;UACvB,GAFY;UAGZkB,QAAQ;YAACZ;;QACX;;QAEAG;;QAEAC;QACAC;QACAC;;QAEA;UACEP,SAASQ;UACTC,UAAUF;QACZ;;MAEFG,SAAS;QAACL;QAAmBC;;IAC/B;EACF;AACF;;;;;;AWvHA,SAASU,eAAAA,oBAAmB;AA6BrB,IAAMC,UAAU,wBACrBC,MACAC,MAAe,UAAK;AAGpB,MAAIC;AAEJ,MAAI,CAACC,MAAMC,QAAQJ,IAAAA,KAAS,OAAOA,SAAS,UAAU;AAEpDE,kBAAc;MACZG,OAAO;QAACL;;MACRC;IACF;EACF,WAAWE,MAAMC,QAAQJ,IAAAA,KAASA,KAAKM,KAAK,CAACN,UAAS,OAAOA,UAAS,QAAA,GAAW;AAE/EE,kBAAc;MACZG,OAAOL;MACPC;IACF;EACF,OAAO;AACL,UAAM,IAAIM,MAAM,gCAAgCC,KAAKC,UAAUT,IAAAA,CAAAA;EACjE;AAEA,SAAOU,aAAYC,WAAWT,WAAAA;AAChC,GAxBuB;","names":["Module","APP_GUARD","Reflector","Injectable","Logger","HttpStatus","Inject","Module","APP_GUARD","Reflector","Injectable","SetMetadata","AUTHNPAAS_MODULE_OPTIONS","Symbol","NEED_LOGIN_KEY","AuthNPaasGuard","reflector","canActivate","context","http","switchToHttp","request","getRequest","response","getResponse","userId","loginUrl","userContext","needLoginMeta","getAllAndOverride","getHandler","getClass","redirect","AuthNPaasModule","forRoot","options","module","global","controllers","providers","provide","useValue","Reflector","APP_GUARD","useClass","exports","IS_PUBLIC_KEY","Public","__name","SetMetadata","ANONYMOUS_USER_ID","PERMISSION_API_CONFIG_TOKEN","Symbol","AUTHZPAAS_MODULE_OPTIONS","ROLES_KEY","Injectable","AbilityBuilder","PureAbility","ROLE_SUBJECT","AbilityFactory","createForUser","permissionData","can","build","AbilityBuilder","PureAbility","role","roles","HttpException","PermissionDeniedType","PermissionDeniedException","HttpException","type","details","httpStatusCode","statusCode","cause","message","requiredRoles","requiredPermissions","environmentRequirement","metadata","name","unauthenticated","roleRequired","and","join","permissionRequired","or","customMessage","length","perm","subject","actions","map","PermissionService","logger","Logger","name","apiConfig","abilityFactory","getUserPermissions","requestDto","requestPromise","userId","ANONYMOUS_USER_ID","permissionData","fetchFromApi","dataWithTimestamp","fetchedAt","Date","error","timeout","baseUrl","appId","cookie","csrfToken","url","requestHeaders","Cookie","controller","AbortController","timeoutId","setTimeout","abort","response","fetch","method","credentials","headers","signal","clearTimeout","ok","Error","status","statusText","PermissionDeniedException","cause","type","PermissionDeniedType","PERMISSION_CONFIG_QUERY_FAILED","message","HttpStatus","INTERNAL_SERVER_ERROR","data","json","roles","roleList","console","log","err","checkRoles","requirement","userContext","BAD_REQUEST","ability","createForUser","and","checkResults","map","role","can","ROLE_SUBJECT","hasRole","every","result","some","userRoles","warn","join","roleRequired","Injectable","Reflector","AuthZPaasGuard","reflector","permissionService","canActivate","context","http","switchToHttp","request","getRequest","cookie","headers","csrfToken","baseUrl","protocol","get","userContext","checkRoleRequirement","getAllAndOverride","ROLES_KEY","getHandler","getClass","checkRoles","AuthZPaasModule","forRoot","options","permissionApi","module","global","controllers","providers","provide","AUTHZPAAS_MODULE_OPTIONS","useValue","PERMISSION_API_CONFIG_TOKEN","Reflector","PermissionService","AbilityFactory","AuthZPaasGuard","APP_GUARD","useClass","exports","forRootAsync","imports","inject","useFactory","moduleOptions","SetMetadata","CanRole","role","and","requirement","Array","isArray","roles","some","Error","JSON","stringify","SetMetadata","ROLES_KEY"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lark-apaas/nestjs-authzpaas",
-  "version": "0.1.0-alpha.1",
+  "version": "0.1.0-alpha.11",
   "description": "FullStack Nestjs authzpaas",
   "type": "module",
   "main": "./dist/index.js",