@lenne.tech/nest-server 11.43.3 → 12.1.0

package/dist/core/common/plugins/mongoose-audit-fields.plugin.js

@@ -1,121 +1,74 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.mongooseAuditFieldsPlugin = mongooseAuditFieldsPlugin;
-const request_context_service_1 = require("../services/request-context.service");
-function mongooseAuditFieldsPlugin(schema) {
-    const hasCreatedBy = !!schema.path('createdBy');
-    const hasUpdatedBy = !!schema.path('updatedBy');
-    if (!hasCreatedBy && !hasUpdatedBy) {
+import { resolveAuditActorId, stampAuditOnReplace, stampAuditOnUpdate, stampAuditOnWrite, } from '../persistence/policies/audit.policy.js';
+export function mongooseAuditFieldsPlugin(schema) {
+    const fields = {
+        createdBy: !!schema.path('createdBy'),
+        updatedBy: !!schema.path('updatedBy'),
+    };
+    if (!fields.createdBy && !fields.updatedBy) {
         return;
     }
     schema.pre('save', function () {
-        const currentUser = request_context_service_1.RequestContext.getCurrentUser();
-        if (!currentUser?.id) {
+        const actorId = resolveAuditActorId();
+        if (!actorId) {
             return;
         }
-        if (hasCreatedBy && this.isNew && !this['createdBy']) {
-            this['createdBy'] = currentUser.id;
-        }
-        if (hasUpdatedBy) {
-            this['updatedBy'] = currentUser.id;
-        }
+        stampAuditOnWrite(this, actorId, fields, this.isNew);
     });
-    if (hasUpdatedBy) {
+    if (fields.updatedBy) {
         const updateHook = function () {
-            const currentUser = request_context_service_1.RequestContext.getCurrentUser();
-            if (!currentUser?.id) {
+            const actorId = resolveAuditActorId();
+            if (!actorId) {
                 return;
             }
             const update = this.getUpdate();
             if (!update) {
                 return;
             }
-            update['updatedBy'] = currentUser.id;
-            if (update.$set) {
-                update.$set['updatedBy'] = currentUser.id;
-            }
-            if (hasCreatedBy && !update['createdBy'] && !update.$set?.['createdBy']) {
-                if (!update.$setOnInsert) {
-                    update.$setOnInsert = {};
-                }
-                if (!update.$setOnInsert['createdBy']) {
-                    update.$setOnInsert['createdBy'] = currentUser.id;
-                }
-            }
+            stampAuditOnUpdate(update, actorId, fields);
         };
         schema.pre('findOneAndUpdate', updateHook);
         schema.pre('updateOne', updateHook);
         schema.pre('updateMany', updateHook);
         const replaceHook = function () {
-            const currentUser = request_context_service_1.RequestContext.getCurrentUser();
-            if (!currentUser?.id) {
+            const actorId = resolveAuditActorId();
+            if (!actorId) {
                 return;
             }
             const replacement = this.getUpdate();
             if (!replacement) {
                 return;
             }
-            replacement['updatedBy'] = currentUser.id;
-            if (hasCreatedBy && !replacement['createdBy']) {
-                replacement['createdBy'] = currentUser.id;
-            }
+            stampAuditOnReplace(replacement, actorId, fields);
         };
         schema.pre('replaceOne', replaceHook);
         schema.pre('findOneAndReplace', replaceHook);
     }
     schema.pre('insertMany', function (docs) {
-        const currentUser = request_context_service_1.RequestContext.getCurrentUser();
-        if (!currentUser?.id)
+        const actorId = resolveAuditActorId();
+        if (!actorId)
             return;
         if (!Array.isArray(docs))
             return;
         for (const doc of docs) {
-            if (hasCreatedBy && !doc.createdBy) {
-                doc.createdBy = currentUser.id;
-            }
-            if (hasUpdatedBy) {
-                doc.updatedBy = currentUser.id;
-            }
+            stampAuditOnWrite(doc, actorId, fields, true);
         }
     });
     schema.pre('bulkWrite', function (ops) {
-        const currentUser = request_context_service_1.RequestContext.getCurrentUser();
-        if (!currentUser?.id)
+        const actorId = resolveAuditActorId();
+        if (!actorId)
             return;
         for (const op of ops) {
             if ('insertOne' in op) {
-                if (hasCreatedBy && !op.insertOne.document.createdBy) {
-                    op.insertOne.document.createdBy = currentUser.id;
-                }
-                if (hasUpdatedBy) {
-                    op.insertOne.document.updatedBy = currentUser.id;
-                }
+                stampAuditOnWrite(op.insertOne.document, actorId, fields, true);
             }
             else if ('updateOne' in op || 'updateMany' in op) {
                 const update = 'updateOne' in op ? op.updateOne.update : op.updateMany.update;
                 if (!update)
                     continue;
-                if (hasUpdatedBy) {
-                    update['updatedBy'] = currentUser.id;
-                    if (update.$set) {
-                        update.$set['updatedBy'] = currentUser.id;
-                    }
-                }
-                if (hasCreatedBy && !update['createdBy'] && !update.$set?.['createdBy']) {
-                    if (!update.$setOnInsert)
-                        update.$setOnInsert = {};
-                    if (!update.$setOnInsert['createdBy']) {
-                        update.$setOnInsert['createdBy'] = currentUser.id;
-                    }
-                }
+                stampAuditOnUpdate(update, actorId, fields);
             }
             else if ('replaceOne' in op) {
-                if (hasUpdatedBy) {
-                    op.replaceOne.replacement['updatedBy'] = currentUser.id;
-                }
-                if (hasCreatedBy && !op.replaceOne.replacement['createdBy']) {
-                    op.replaceOne.replacement['createdBy'] = currentUser.id;
-                }
+                stampAuditOnReplace(op.replaceOne.replacement, actorId, fields);
             }
         }
     });

package/dist/core/common/plugins/mongoose-audit-fields.plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"mongoose-audit-fields.plugin.js","sourceRoot":"","sources":["../../../../src/core/common/plugins/mongoose-audit-fields.plugin.ts"],"names":[],"mappings":";;AAmBA,8DA0IC;AA7JD,iFAAqE;AAmBrE,SAAgB,yBAAyB,CAAC,MAAM;IAC9C,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAGhD,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,OAAO;IACT,CAAC;IAGD,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE;QACjB,MAAM,WAAW,GAAG,wCAAc,CAAC,cAAc,EAAE,CAAC;QACpD,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QAED,IAAI,YAAY,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;QACrC,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;QACrC,CAAC;IACH,CAAC,CAAC,CAAC;IAGH,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,UAAU,GAAG;YACjB,MAAM,WAAW,GAAG,wCAAc,CAAC,cAAc,EAAE,CAAC;YACpD,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC;gBACrB,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YAGD,MAAM,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;YACrC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;YAC5C,CAAC;YAID,IAAI,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;gBACxE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;oBACzB,MAAM,CAAC,YAAY,GAAG,EAAE,CAAC;gBAC3B,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;oBACtC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;gBACpD,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAGrC,MAAM,WAAW,GAAG;YAClB,MAAM,WAAW,GAAG,wCAAc,CAAC,cAAc,EAAE,CAAC;YACpD,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC;gBACrB,OAAO;YACT,CAAC;YAED,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;YAED,WAAW,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;YAG1C,IAAI,YAAY,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC9C,WAAW,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;YAC5C,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;IAC/C,CAAC;IAID,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,IAAI;QACrC,MAAM,WAAW,GAAG,wCAAc,CAAC,cAAc,EAAE,CAAC;QACpD,IAAI,CAAC,WAAW,EAAE,EAAE;YAAE,OAAO;QAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO;QAEjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,YAAY,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;gBACnC,GAAG,CAAC,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC;YACjC,CAAC;YACD,IAAI,YAAY,EAAE,CAAC;gBACjB,GAAG,CAAC,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,GAAG;QACnC,MAAM,WAAW,GAAG,wCAAc,CAAC,cAAc,EAAE,CAAC;QACpD,IAAI,CAAC,WAAW,EAAE,EAAE;YAAE,OAAO;QAE7B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,WAAW,IAAI,EAAE,EAAE,CAAC;gBACtB,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;oBACrD,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC;gBACnD,CAAC;gBACD,IAAI,YAAY,EAAE,CAAC;oBACjB,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC;gBACnD,CAAC;YACH,CAAC;iBAAM,IAAI,WAAW,IAAI,EAAE,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;gBACnD,MAAM,MAAM,GAAG,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;gBAC9E,IAAI,CAAC,MAAM;oBAAE,SAAS;gBACtB,IAAI,YAAY,EAAE,CAAC;oBACjB,MAAM,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;oBACrC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;wBAChB,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;oBAC5C,CAAC;gBACH,CAAC;gBACD,IAAI,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;oBACxE,IAAI,CAAC,MAAM,CAAC,YAAY;wBAAE,MAAM,CAAC,YAAY,GAAG,EAAE,CAAC;oBACnD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;wBACtC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;oBACpD,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;gBAC9B,IAAI,YAAY,EAAE,CAAC;oBACjB,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;gBAC1D,CAAC;gBACD,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC5D,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;gBAC1D,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"mongoose-audit-fields.plugin.js","sourceRoot":"","sources":["../../../../src/core/common/plugins/mongoose-audit-fields.plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,yCAAyC,CAAC;AAsBjD,MAAM,UAAU,yBAAyB,CAAC,MAAM;IAC9C,MAAM,MAAM,GAAuB;QACjC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;KACtC,CAAC;IAGF,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC3C,OAAO;IACT,CAAC;IAGD,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE;QACjB,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAGH,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG;YACjB,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;YACtC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YAED,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC,CAAC;QAEF,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAGrC,MAAM,WAAW,GAAG;YAClB,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;YACtC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YAED,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;YAED,mBAAmB,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC,CAAC;QAEF,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;IAC/C,CAAC;IAID,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,IAAI;QACrC,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO;QAEjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,GAAG;QACnC,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,WAAW,IAAI,EAAE,EAAE,CAAC;gBACtB,iBAAiB,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAClE,CAAC;iBAAM,IAAI,WAAW,IAAI,EAAE,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;gBACnD,MAAM,MAAM,GAAG,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;gBAC9E,IAAI,CAAC,MAAM;oBAAE,SAAS;gBACtB,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC9C,CAAC;iBAAM,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;gBAC9B,mBAAmB,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/core/common/plugins/mongoose-id.plugin.js

@@ -1,10 +1,10 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.mongooseIdPlugin = mongooseIdPlugin;
-function mongooseIdPlugin(schema) {
+export function mongooseIdPlugin(schema) {
     schema.post(/.*/, (docs) => {
         const docsArray = Array.isArray(docs) ? docs : [docs];
         for (const doc of docsArray) {
+            if (doc?._bsontype === 'ObjectId') {
+                continue;
+            }
             if (doc?._id && typeof doc._id.toHexString === 'function') {
                 doc.id = doc._id.toHexString();
             }

package/dist/core/common/plugins/mongoose-id.plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"mongoose-id.plugin.js","sourceRoot":"","sources":["../../../../src/core/common/plugins/mongoose-id.plugin.ts"],"names":[],"mappings":";;AAIA,4CASC;AATD,SAAgB,gBAAgB,CAAC,MAAM;IACrC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QACzB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,IAAI,GAAG,EAAE,GAAG,IAAI,OAAO,GAAG,CAAC,GAAG,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBAC1D,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"mongoose-id.plugin.js","sourceRoot":"","sources":["../../../../src/core/common/plugins/mongoose-id.plugin.ts"],"names":[],"mappings":"AAIA,MAAM,UAAU,gBAAgB,CAAC,MAAM;IACrC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QACzB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAO5B,IAAI,GAAG,EAAE,SAAS,KAAK,UAAU,EAAE,CAAC;gBAClC,SAAS;YACX,CAAC;YACD,IAAI,GAAG,EAAE,GAAG,IAAI,OAAO,GAAG,CAAC,GAAG,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBAC1D,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/core/common/plugins/mongoose-password.plugin.d.ts

@@ -1,4 +1,2 @@
+export { hashPassword, hashUpdatePassword, resetSkipPatternsCache } from '../persistence/policies/password.policy.js';
 export declare function mongoosePasswordPlugin(schema: any): void;
-export declare function hashUpdatePassword(update: any): Promise<void>;
-export declare function resetSkipPatternsCache(): void;
-export declare function hashPassword(password: string): Promise<string>;

package/dist/core/common/plugins/mongoose-password.plugin.js

@@ -1,13 +1,6 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.mongoosePasswordPlugin = mongoosePasswordPlugin;
-exports.hashUpdatePassword = hashUpdatePassword;
-exports.resetSkipPatternsCache = resetSkipPatternsCache;
-exports.hashPassword = hashPassword;
-const bcrypt = require("bcrypt");
-const js_sha256_1 = require("js-sha256");
-const config_service_1 = require("../services/config.service");
-function mongoosePasswordPlugin(schema) {
+import { hashPassword, hashUpdatePassword } from '../persistence/policies/password.policy.js';
+export { hashPassword, hashUpdatePassword, resetSkipPatternsCache } from '../persistence/policies/password.policy.js';
+export function mongoosePasswordPlugin(schema) {
     schema.pre('save', async function () {
         if (!this.isModified('password') || !this['password']) {
             return;
@@ -59,46 +52,4 @@ function mongoosePasswordPlugin(schema) {
         }
     });
 }
-async function hashUpdatePassword(update) {
-    if (!update) {
-        return;
-    }
-    if (update.password) {
-        update.password = await hashPassword(update.password);
-    }
-    if (update.$set?.password) {
-        update.$set.password = await hashPassword(update.$set.password);
-    }
-}
-let compiledSkipPatterns = null;
-function resetSkipPatternsCache() {
-    compiledSkipPatterns = null;
-}
-function getSkipPatterns() {
-    if (compiledSkipPatterns !== null) {
-        return compiledSkipPatterns;
-    }
-    const pluginConfig = config_service_1.ConfigService.configFastButReadOnly?.security?.mongoosePasswordPlugin;
-    if (pluginConfig && typeof pluginConfig === 'object' && 'skipPatterns' in pluginConfig && pluginConfig.skipPatterns) {
-        compiledSkipPatterns = pluginConfig.skipPatterns.map((p) => p instanceof RegExp ? p : new RegExp(p));
-    }
-    else {
-        compiledSkipPatterns = [];
-    }
-    return compiledSkipPatterns;
-}
-async function hashPassword(password) {
-    if (/^\$2[aby]\$\d+\$/.test(password)) {
-        return password;
-    }
-    const skipPatterns = getSkipPatterns();
-    if (skipPatterns.some((pattern) => pattern.test(password))) {
-        return password;
-    }
-    const sha256Enabled = config_service_1.ConfigService.configFastButReadOnly?.sha256;
-    if (sha256Enabled && !/^[a-f0-9]{64}$/i.test(password)) {
-        password = (0, js_sha256_1.sha256)(password);
-    }
-    return bcrypt.hash(password, 10);
-}
 //# sourceMappingURL=mongoose-password.plugin.js.map

package/dist/core/common/plugins/mongoose-password.plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"mongoose-password.plugin.js","sourceRoot":"","sources":["../../../../src/core/common/plugins/mongoose-password.plugin.ts"],"names":[],"mappings":";;AAkBA,wDA8DC;AAED,gDAUC;AASD,wDAEC;AAiBD,oCAmBC;AA3ID,iCAAkC;AAClC,yCAAmC;AAEnC,+DAA2D;AAe3D,SAAgB,sBAAsB,CAAC,MAAM;IAE3C,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK;QACtB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACtD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK;QAClC,MAAM,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK;QAC3B,MAAM,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK;QAC5B,MAAM,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK;QAC5B,MAAM,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK;QACnC,MAAM,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,WAAW,IAAI;QAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO;QACjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjB,GAAG,CAAC,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,WAAW,GAAG;QACzC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,WAAW,IAAI,EAAE,EAAE,CAAC;gBACtB,IAAI,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC;oBACpC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACtF,CAAC;YACH,CAAC;iBAAM,IAAI,WAAW,IAAI,EAAE,EAAE,CAAC;gBAC7B,MAAM,kBAAkB,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC;iBAAM,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;gBAC9B,MAAM,kBAAkB,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACjD,CAAC;iBAAM,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;gBAC9B,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC;oBACxC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;gBAC9F,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,kBAAkB,CAAC,MAAW;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,CAAC,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAGD,IAAI,oBAAoB,GAAoB,IAAI,CAAC;AAMjD,SAAgB,sBAAsB;IACpC,oBAAoB,GAAG,IAAI,CAAC;AAC9B,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,MAAM,YAAY,GAAG,8BAAa,CAAC,qBAAqB,EAAE,QAAQ,EAAE,sBAAsB,CAAC;IAC3F,IAAI,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,cAAc,IAAI,YAAY,IAAI,YAAY,CAAC,YAAY,EAAE,CAAC;QACpH,oBAAoB,GAAI,YAAY,CAAC,YAAoC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAClF,CAAC,YAAY,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CACxC,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,oBAAoB,GAAG,EAAE,CAAC;IAC5B,CAAC;IACD,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,QAAgB;IAEjD,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAGD,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC3D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAGD,MAAM,aAAa,GAAG,8BAAa,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAClE,IAAI,aAAa,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,QAAQ,GAAG,IAAA,kBAAM,EAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC"}
+{"version":3,"file":"mongoose-password.plugin.js","sourceRoot":"","sources":["../../../../src/core/common/plugins/mongoose-password.plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAG9F,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAkBtH,MAAM,UAAU,sBAAsB,CAAC,MAAM;IAE3C,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK;QACtB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACtD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK;QAClC,MAAM,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK;QAC3B,MAAM,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK;QAC5B,MAAM,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK;QAC5B,MAAM,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK;QACnC,MAAM,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,WAAW,IAAI;QAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO;QACjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjB,GAAG,CAAC,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,WAAW,GAAG;QACzC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,WAAW,IAAI,EAAE,EAAE,CAAC;gBACtB,IAAI,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC;oBACpC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACtF,CAAC;YACH,CAAC;iBAAM,IAAI,WAAW,IAAI,EAAE,EAAE,CAAC;gBAC7B,MAAM,kBAAkB,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC;iBAAM,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;gBAC9B,MAAM,kBAAkB,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACjD,CAAC;iBAAM,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;gBAC9B,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC;oBACxC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;gBAC9F,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/core/common/plugins/mongoose-role-guard.plugin.js

@@ -1,12 +1,8 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.mongooseRoleGuardPlugin = mongooseRoleGuardPlugin;
-const common_1 = require("@nestjs/common");
-const role_enum_1 = require("../enums/role.enum");
-const config_service_1 = require("../services/config.service");
-const request_context_service_1 = require("../services/request-context.service");
-const logger = new common_1.Logger('mongooseRoleGuardPlugin');
-function mongooseRoleGuardPlugin(schema) {
+import { Logger } from '@nestjs/common';
+import { isRoleChangeAllowed, stripRoleChanges, updateChangesRoles, } from '../persistence/policies/role-guard.policy.js';
+import { RequestContext } from '../services/request-context.service.js';
+const logger = new Logger('mongooseRoleGuardPlugin');
+export function mongooseRoleGuardPlugin(schema) {
     schema.pre('save', function () {
         if (!this.isModified('roles')) {
             return;
@@ -14,7 +10,7 @@ function mongooseRoleGuardPlugin(schema) {
         if (isRoleChangeAllowed()) {
             return;
         }
-        const currentUser = request_context_service_1.RequestContext.getCurrentUser();
+        const currentUser = RequestContext.getCurrentUser();
         logger.debug(`[nest-server] mongooseRoleGuardPlugin: Blocked role change on ${this.isNew ? 'new' : 'existing'} document by user ${currentUser?.id || 'unknown'}`);
         if (this.isNew) {
             this['roles'] = [];
@@ -45,7 +41,7 @@ function mongooseRoleGuardPlugin(schema) {
             return;
         if (isRoleChangeAllowed())
             return;
-        const currentUser = request_context_service_1.RequestContext.getCurrentUser();
+        const currentUser = RequestContext.getCurrentUser();
         logger.debug(`Stripped unauthorized roles from insertMany by user ${currentUser?.id || 'unknown'}`);
         for (const doc of docs) {
             if (doc.roles) {
@@ -58,9 +54,9 @@ function mongooseRoleGuardPlugin(schema) {
             if ('insertOne' in op)
                 return !!op.insertOne.document?.roles?.length;
             if ('updateOne' in op)
-                return hasRolesInUpdate(op.updateOne.update);
+                return updateChangesRoles(op.updateOne.update);
             if ('updateMany' in op)
-                return hasRolesInUpdate(op.updateMany.update);
+                return updateChangesRoles(op.updateMany.update);
             if ('replaceOne' in op)
                 return !!op.replaceOne.replacement?.roles?.length;
             return false;
@@ -69,7 +65,7 @@ function mongooseRoleGuardPlugin(schema) {
             return;
         if (isRoleChangeAllowed())
             return;
-        const currentUser = request_context_service_1.RequestContext.getCurrentUser();
+        const currentUser = RequestContext.getCurrentUser();
         logger.debug(`Stripped unauthorized roles from bulkWrite by user ${currentUser?.id || 'unknown'}`);
         for (const op of ops) {
             if ('insertOne' in op) {
@@ -91,58 +87,18 @@ function mongooseRoleGuardPlugin(schema) {
         }
     });
 }
-function isRoleChangeAllowed() {
-    const currentUser = request_context_service_1.RequestContext.getCurrentUser();
-    if (!currentUser) {
-        return true;
-    }
-    if (request_context_service_1.RequestContext.isBypassRoleGuard()) {
-        return true;
-    }
-    if (currentUser.hasRole?.([role_enum_1.RoleEnum.ADMIN]) || currentUser.roles?.includes(role_enum_1.RoleEnum.ADMIN)) {
-        return true;
-    }
-    const pluginConfig = config_service_1.ConfigService.configFastButReadOnly?.security?.mongooseRoleGuardPlugin;
-    if (pluginConfig && typeof pluginConfig === 'object' && 'allowedRoles' in pluginConfig && pluginConfig.allowedRoles) {
-        const allowedRoles = pluginConfig.allowedRoles;
-        if (currentUser.roles?.some((role) => allowedRoles.includes(role))) {
-            return true;
-        }
-    }
-    return false;
-}
-function hasRolesInUpdate(update) {
-    return !!(update?.roles ||
-        update?.$set?.roles ||
-        update?.$push?.roles ||
-        update?.$addToSet?.roles ||
-        update?.$pull?.roles);
-}
 function handleUpdateRoleGuard(update) {
     if (!update) {
         return;
     }
-    const hasRolesUpdate = update.roles || update.$set?.roles || update?.$push?.roles || update.$addToSet?.roles || update.$pull?.roles;
-    if (!hasRolesUpdate) {
+    if (!updateChangesRoles(update)) {
         return;
     }
     if (isRoleChangeAllowed()) {
         return;
     }
-    const currentUser = request_context_service_1.RequestContext.getCurrentUser();
+    const currentUser = RequestContext.getCurrentUser();
     logger.debug(`Stripped unauthorized roles change from user ${currentUser?.id || 'unknown'}`);
-    delete update.roles;
-    if (update.$set?.roles) {
-        delete update.$set.roles;
-    }
-    if (update.$push?.roles) {
-        delete update.$push.roles;
-    }
-    if (update.$addToSet?.roles) {
-        delete update.$addToSet.roles;
-    }
-    if (update.$pull?.roles) {
-        delete update.$pull.roles;
-    }
+    stripRoleChanges(update);
 }
 //# sourceMappingURL=mongoose-role-guard.plugin.js.map

package/dist/core/common/plugins/mongoose-role-guard.plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"mongoose-role-guard.plugin.js","sourceRoot":"","sources":["../../../../src/core/common/plugins/mongoose-role-guard.plugin.ts"],"names":[],"mappings":";;AAmDA,0DA8FC;AAjJD,2CAAwC;AAExC,kDAA8C;AAC9C,+DAA2D;AAC3D,iFAAqE;AAErE,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,yBAAyB,CAAC,CAAC;AA6CrD,SAAgB,uBAAuB,CAAC,MAAM;IAE5C,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE;QACjB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,IAAI,mBAAmB,EAAE,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;QAGD,MAAM,WAAW,GAAG,wCAAc,CAAC,cAAc,EAAE,CAAC;QACpD,MAAM,CAAC,KAAK,CACV,iEAAiE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,qBAAqB,WAAW,EAAE,EAAE,IAAI,SAAS,EAAE,CACpJ,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACrB,CAAC;aAAM,CAAC;YAEN,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE;QAC7B,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE;QACtB,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE;QACvB,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE;QACvB,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE;QAC9B,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,IAAI;QACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO;QACjC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC;YAAE,OAAO;QACvD,IAAI,mBAAmB,EAAE;YAAE,OAAO;QAElC,MAAM,WAAW,GAAG,wCAAc,CAAC,cAAc,EAAE,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,uDAAuD,WAAW,EAAE,EAAE,IAAI,SAAS,EAAE,CAAC,CAAC;QACpG,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBACd,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,GAAG;QACnC,MAAM,gBAAgB,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;YACvC,IAAI,WAAW,IAAI,EAAE;gBAAE,OAAO,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC;YACrE,IAAI,WAAW,IAAI,EAAE;gBAAE,OAAO,gBAAgB,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACpE,IAAI,YAAY,IAAI,EAAE;gBAAE,OAAO,gBAAgB,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACtE,IAAI,YAAY,IAAI,EAAE;gBAAE,OAAO,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB;YAAE,OAAO;QAC9B,IAAI,mBAAmB,EAAE;YAAE,OAAO;QAElC,MAAM,WAAW,GAAG,wCAAc,CAAC,cAAc,EAAE,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,sDAAsD,WAAW,EAAE,EAAE,IAAI,SAAS,EAAE,CAAC,CAAC;QACnG,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,WAAW,IAAI,EAAE,EAAE,CAAC;gBACtB,IAAI,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC;oBACjC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC;gBACnC,CAAC;YACH,CAAC;iBAAM,IAAI,WAAW,IAAI,EAAE,EAAE,CAAC;gBAC7B,qBAAqB,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC7C,CAAC;iBAAM,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;gBAC9B,qBAAqB,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAC9C,CAAC;iBAAM,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;gBAC9B,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC;oBACrC,OAAO,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC;gBACzC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAUD,SAAS,mBAAmB;IAC1B,MAAM,WAAW,GAAG,wCAAc,CAAC,cAAc,EAAE,CAAC;IAEpD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,wCAAc,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,oBAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,oBAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IAGD,MAAM,YAAY,GAAG,8BAAa,CAAC,qBAAqB,EAAE,QAAQ,EAAE,uBAAuB,CAAC;IAC5F,IAAI,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,cAAc,IAAI,YAAY,IAAI,YAAY,CAAC,YAAY,EAAE,CAAC;QACpH,MAAM,YAAY,GAAa,YAAY,CAAC,YAAwB,CAAC;QACrE,IAAI,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAW;IACnC,OAAO,CAAC,CAAC,CACP,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,IAAI,EAAE,KAAK;QACnB,MAAM,EAAE,KAAK,EAAE,KAAK;QACpB,MAAM,EAAE,SAAS,EAAE,KAAK;QACxB,MAAM,EAAE,KAAK,EAAE,KAAK,CACrB,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAW;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IAED,MAAM,cAAc,GAClB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI,MAAM,EAAE,KAAK,EAAE,KAAK,IAAI,MAAM,CAAC,SAAS,EAAE,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC;IAC/G,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IAED,IAAI,mBAAmB,EAAE,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAGD,MAAM,WAAW,GAAG,wCAAc,CAAC,cAAc,EAAE,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,gDAAgD,WAAW,EAAE,EAAE,IAAI,SAAS,EAAE,CAAC,CAAC;IAC7F,OAAO,MAAM,CAAC,KAAK,CAAC;IACpB,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;IAC3B,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;IAC5B,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;IAChC,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;IAC5B,CAAC;AACH,CAAC"}
+{"version":3,"file":"mongoose-role-guard.plugin.js","sourceRoot":"","sources":["../../../../src/core/common/plugins/mongoose-role-guard.plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,yBAAyB,CAAC,CAAC;AA6CrD,MAAM,UAAU,uBAAuB,CAAC,MAAM;IAE5C,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE;QACjB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,IAAI,mBAAmB,EAAE,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;QAGD,MAAM,WAAW,GAAG,cAAc,CAAC,cAAc,EAAE,CAAC;QACpD,MAAM,CAAC,KAAK,CACV,iEAAiE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,qBAAqB,WAAW,EAAE,EAAE,IAAI,SAAS,EAAE,CACpJ,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACrB,CAAC;aAAM,CAAC;YAEN,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE;QAC7B,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE;QACtB,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE;QACvB,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE;QACvB,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE;QAC9B,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,IAAI;QACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO;QACjC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC;YAAE,OAAO;QACvD,IAAI,mBAAmB,EAAE;YAAE,OAAO;QAElC,MAAM,WAAW,GAAG,cAAc,CAAC,cAAc,EAAE,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,uDAAuD,WAAW,EAAE,EAAE,IAAI,SAAS,EAAE,CAAC,CAAC;QACpG,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBACd,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAGH,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,GAAG;QACnC,MAAM,gBAAgB,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;YACvC,IAAI,WAAW,IAAI,EAAE;gBAAE,OAAO,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC;YACrE,IAAI,WAAW,IAAI,EAAE;gBAAE,OAAO,kBAAkB,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACtE,IAAI,YAAY,IAAI,EAAE;gBAAE,OAAO,kBAAkB,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACxE,IAAI,YAAY,IAAI,EAAE;gBAAE,OAAO,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB;YAAE,OAAO;QAC9B,IAAI,mBAAmB,EAAE;YAAE,OAAO;QAElC,MAAM,WAAW,GAAG,cAAc,CAAC,cAAc,EAAE,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,sDAAsD,WAAW,EAAE,EAAE,IAAI,SAAS,EAAE,CAAC,CAAC;QACnG,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,WAAW,IAAI,EAAE,EAAE,CAAC;gBACtB,IAAI,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC;oBACjC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC;gBACnC,CAAC;YACH,CAAC;iBAAM,IAAI,WAAW,IAAI,EAAE,EAAE,CAAC;gBAC7B,qBAAqB,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC7C,CAAC;iBAAM,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;gBAC9B,qBAAqB,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAC9C,CAAC;iBAAM,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;gBAC9B,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC;oBACrC,OAAO,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC;gBACzC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAMD,SAAS,qBAAqB,CAAC,MAAW;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IAED,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO;IACT,CAAC;IAED,IAAI,mBAAmB,EAAE,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAGD,MAAM,WAAW,GAAG,cAAc,CAAC,cAAc,EAAE,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,gDAAgD,WAAW,EAAE,EAAE,IAAI,SAAS,EAAE,CAAC,CAAC;IAC7F,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC"}

package/dist/core/common/plugins/mongoose-system-role.plugin.js

@@ -1,9 +1,5 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.mongooseSystemRolePlugin = mongooseSystemRolePlugin;
-const common_1 = require("@nestjs/common");
-const role_enum_1 = require("../enums/role.enum");
-function mongooseSystemRolePlugin(schema) {
+import { assertNoSystemRoles, assertUpdateHasNoSystemRoles, toRoleArray, updateMayIntroduceSystemRoles, } from '../persistence/policies/system-role.policy.js';
+export function mongooseSystemRolePlugin(schema) {
     schema.pre('save', function () {
         if (!this.isModified('roles')) {
             return;
@@ -49,21 +45,9 @@ function mongooseSystemRolePlugin(schema) {
         }
     });
 }
-function toRoleArray(value) {
-    return Array.isArray(value) ? value.filter((entry) => typeof entry === 'string') : [];
-}
-function assertNoSystemRoles(roles, alreadyStored = []) {
-    if (!Array.isArray(roles)) {
-        return;
-    }
-    const introduced = roles.filter((role) => (0, role_enum_1.looksLikeSystemRole)(role) && !alreadyStored.includes(role));
-    if (introduced.length) {
-        throw new common_1.BadRequestException(`System roles (${role_enum_1.SYSTEM_ROLE_PREFIX}*) must never be stored in user.roles: ${introduced.join(', ')}`);
-    }
-}
 async function assertUpdateIntroducesNoSystemRoles(query) {
     const update = query.getUpdate();
-    if (!update || !collectRoleValues(update).some((role) => (0, role_enum_1.looksLikeSystemRole)(role))) {
+    if (!update || !updateMayIntroduceSystemRoles(update)) {
         return;
     }
     let stored = [];
@@ -75,32 +59,4 @@ async function assertUpdateIntroducesNoSystemRoles(query) {
     }
     assertUpdateHasNoSystemRoles(update, stored);
 }
-function collectRoleValues(update) {
-    const values = [
-        ...toRoleArray(update.roles),
-        ...toRoleArray(update.$set?.roles),
-        ...toRoleArray(update.$setOnInsert?.roles),
-    ];
-    for (const operator of [update.$push?.roles, update.$addToSet?.roles]) {
-        if (operator === undefined || operator === null) {
-            continue;
-        }
-        values.push(...(Array.isArray(operator?.$each) ? operator.$each : [operator]));
-    }
-    return values;
-}
-function assertUpdateHasNoSystemRoles(update, alreadyStored = []) {
-    if (!update) {
-        return;
-    }
-    assertNoSystemRoles(update.roles, alreadyStored);
-    assertNoSystemRoles(update.$set?.roles, alreadyStored);
-    assertNoSystemRoles(update.$setOnInsert?.roles, alreadyStored);
-    for (const operator of [update.$push?.roles, update.$addToSet?.roles]) {
-        if (operator === undefined || operator === null) {
-            continue;
-        }
-        assertNoSystemRoles(Array.isArray(operator?.$each) ? operator.$each : [operator], alreadyStored);
-    }
-}
 //# sourceMappingURL=mongoose-system-role.plugin.js.map

package/dist/core/common/plugins/mongoose-system-role.plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"mongoose-system-role.plugin.js","sourceRoot":"","sources":["../../../../src/core/common/plugins/mongoose-system-role.plugin.ts"],"names":[],"mappings":";;AAyCA,4DAoDC;AA7FD,2CAAqD;AAErD,kDAA6E;AAuC7E,SAAgB,wBAAwB,CAAC,MAAM;IAC7C,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE;QACjB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAIH,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE;QAClB,IAAI,CAAC,GAAG,CAAC,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,EAAE,YAAY,EAAE,mBAAmB,CAAC,EAAE,CAAC;QACtF,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK;YAClB,MAAM,mCAAmC,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC;IAID,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE;QACvB,4BAA4B,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,IAAI;QACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,GAAG;QACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,WAAW,IAAI,EAAE,EAAE,CAAC;gBACtB,mBAAmB,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACpD,CAAC;iBAAM,IAAI,WAAW,IAAI,EAAE,EAAE,CAAC;gBAC7B,4BAA4B,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACpD,CAAC;iBAAM,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;gBAC9B,4BAA4B,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACrD,CAAC;iBAAM,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;gBAC9B,mBAAmB,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAGD,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACzG,CAAC;AAgBD,SAAS,mBAAmB,CAAC,KAAc,EAAE,gBAA0B,EAAE;IACvE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,+BAAmB,EAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACtG,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,4BAAmB,CAC3B,iBAAiB,8BAAkB,0CAA0C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrG,CAAC;IACJ,CAAC;AACH,CAAC;AAQD,KAAK,UAAU,mCAAmC,CAAC,KAAU;IAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;IACjC,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,+BAAmB,EAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACpF,OAAO;IACT,CAAC;IAGD,IAAI,MAAM,GAAa,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3F,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;IAGT,CAAC;IAED,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC;AAGD,SAAS,iBAAiB,CAAC,MAAW;IACpC,MAAM,MAAM,GAAc;QACxB,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;QAC5B,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC;QAClC,GAAG,WAAW,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC;KAC3C,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;QACtE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAChD,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAQD,SAAS,4BAA4B,CAAC,MAAW,EAAE,gBAA0B,EAAE;IAC7E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IAED,mBAAmB,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACjD,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IACvD,mBAAmB,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAG/D,KAAK,MAAM,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;QACtE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAChD,SAAS;QACX,CAAC;QACD,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAC;IACnG,CAAC;AACH,CAAC"}
+{"version":3,"file":"mongoose-system-role.plugin.js","sourceRoot":"","sources":["../../../../src/core/common/plugins/mongoose-system-role.plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,4BAA4B,EAC5B,WAAW,EACX,6BAA6B,GAC9B,MAAM,+CAA+C,CAAC;AAuCvD,MAAM,UAAU,wBAAwB,CAAC,MAAM;IAC7C,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE;QACjB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAIH,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE;QAClB,IAAI,CAAC,GAAG,CAAC,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,EAAE,YAAY,EAAE,mBAAmB,CAAC,EAAE,CAAC;QACtF,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK;YAClB,MAAM,mCAAmC,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC;IAID,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE;QACvB,4BAA4B,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,IAAI;QACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,GAAG;QACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,WAAW,IAAI,EAAE,EAAE,CAAC;gBACtB,mBAAmB,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACpD,CAAC;iBAAM,IAAI,WAAW,IAAI,EAAE,EAAE,CAAC;gBAC7B,4BAA4B,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACpD,CAAC;iBAAM,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;gBAC9B,4BAA4B,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACrD,CAAC;iBAAM,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;gBAC9B,mBAAmB,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAQD,KAAK,UAAU,mCAAmC,CAAC,KAAU;IAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;IACjC,IAAI,CAAC,MAAM,IAAI,CAAC,6BAA6B,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,OAAO;IACT,CAAC;IAGD,IAAI,MAAM,GAAa,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3F,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;IAGT,CAAC;IAED,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC"}

package/dist/core/common/plugins/mongoose-tenant.plugin.js

@@ -1,25 +1,6 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.mongooseTenantPlugin = mongooseTenantPlugin;
-const common_1 = require("@nestjs/common");
-const config_service_1 = require("../services/config.service");
-const request_context_service_1 = require("../services/request-context.service");
-const isolationDisabledWarned = new Set();
-function warnIsolationDisabled(modelName) {
-    if (isolationDisabledWarned.has(modelName)) {
-        return;
-    }
-    isolationDisabledWarned.add(modelName);
-    const membershipModel = config_service_1.ConfigService.configFastButReadOnly?.multiTenancy?.membershipModel ?? 'TenantMember';
-    if (modelName === membershipModel) {
-        return;
-    }
-    new common_1.Logger('mongooseTenantPlugin').warn(`Tenant isolation is DISABLED for "${modelName}": the schema declares a tenantId field, but ` +
-        `"${modelName}" is listed in multiTenancy.excludeSchemas — so no tenant filter is applied and ` +
-        `every query on it sees every tenant's rows. Remove it from excludeSchemas unless this ` +
-        `collection is genuinely global.`);
-}
-function mongooseTenantPlugin(schema) {
+import { ForbiddenException } from '@nestjs/common';
+import { assertOwnTenant, assertRowsInTenantScope, assertUnfilterableCountAllowed, resolveSingleTenantId, resolveTenantFilter, } from '../persistence/policies/tenant.policy.js';
+export function mongooseTenantPlugin(schema) {
     if (!schema.path('tenantId')) {
         return;
     }
@@ -56,6 +37,13 @@ function mongooseTenantPlugin(schema) {
             }
         });
     }
+    const rowCheckHooks = ['find', 'findOne', 'findOneAndUpdate', 'findOneAndDelete', 'findOneAndReplace'];
+    for (const hookName of rowCheckHooks) {
+        schema.post(hookName, function (result) {
+            const rows = result && typeof result === 'object' && 'lastErrorObject' in result ? result.value : result;
+            assertRowsInTenantScope(this.model?.modelName, rows);
+        });
+    }
     schema.pre('save', function () {
         const modelName = this.constructor.modelName;
         const tenantId = resolveSingleTenantId(modelName);
@@ -112,16 +100,7 @@ function mongooseTenantPlugin(schema) {
         }
     });
     schema.pre('estimatedDocumentCount', function () {
-        const modelName = this.model?.modelName;
-        if (shouldBypass(modelName)) {
-            return;
-        }
-        const context = request_context_service_1.RequestContext.get();
-        if (context?.isAdminBypass && !context?.tenantId) {
-            return;
-        }
-        throw new common_1.ForbiddenException("estimatedDocumentCount() cannot be tenant-filtered and would expose other tenants' row counts — " +
-            'use countDocuments() instead');
+        assertUnfilterableCountAllowed(this.model?.modelName);
     });
     schema.pre('aggregate', function () {
         const model = this._model;
@@ -133,7 +112,7 @@ function mongooseTenantPlugin(schema) {
         const pipeline = this.pipeline();
         const writeStage = pipeline.find((stage) => stage && (stage.$out !== undefined || stage.$merge !== undefined));
         if (writeStage) {
-            throw new common_1.ForbiddenException(`Aggregation write stages ($out / $merge) are not permitted inside a tenant context — ` +
+            throw new ForbiddenException(`Aggregation write stages ($out / $merge) are not permitted inside a tenant context — ` +
                 'they cannot be tenant-filtered. Run them as a system operation if this is intended.');
         }
         pipeline.unshift({ $match: filter });
@@ -204,46 +183,4 @@ function filterForCollection(collectionName, sourceModel) {
     }
     return undefined;
 }
-function assertOwnTenant(value, ownTenantId, isNew) {
-    if (value === undefined || value === null || value === ownTenantId) {
-        return;
-    }
-    throw new common_1.ForbiddenException(isNew
-        ? `Cannot create a document in a foreign tenant (got "${String(value)}", own tenant is "${ownTenantId}")`
-        : `Cannot move a document to a foreign tenant (got "${String(value)}", own tenant is "${ownTenantId}")`);
-}
-function shouldBypass(modelName) {
-    const mtConfig = config_service_1.ConfigService.configFastButReadOnly?.multiTenancy;
-    if (!mtConfig || mtConfig.enabled === false)
-        return true;
-    const context = request_context_service_1.RequestContext.get();
-    if (!context)
-        return true;
-    if (context.bypassTenantGuard)
-        return true;
-    if (modelName && mtConfig.excludeSchemas?.includes(modelName)) {
-        warnIsolationDisabled(modelName);
-        return true;
-    }
-    return false;
-}
-function resolveTenantFilter(modelName) {
-    if (shouldBypass(modelName))
-        return undefined;
-    const context = request_context_service_1.RequestContext.get();
-    const tenantId = context?.tenantId;
-    if (tenantId)
-        return { tenantId };
-    const tenantIds = context?.tenantIds;
-    if (tenantIds)
-        return { tenantId: { $in: tenantIds } };
-    if (context?.isAdminBypass)
-        return {};
-    throw new common_1.ForbiddenException('Tenant context required: this data is tenant-scoped but no valid tenant context was provided');
-}
-function resolveSingleTenantId(modelName) {
-    if (shouldBypass(modelName))
-        return undefined;
-    return request_context_service_1.RequestContext.get()?.tenantId || undefined;
-}
 //# sourceMappingURL=mongoose-tenant.plugin.js.map