@litusarchieve18/agricore-utils 1.0.28 → 1.0.30

package/README.md

@@ -183,7 +183,9 @@ Run the publish command:
 Bash
 npm publish --access public
 📝 Version History
-V1.0.29 — 
+V1.0.30 — altered authscoped Id to receive a list of string not a single string
+
+V1.0.29 — altered filtering logic from validFrom_lte: targetIso to validFrom: { $lte: targetIso }
 
 V1.0.28 — altered the logic and added scope aware filtering and write-time validation in priceHelpers.ts
 

package/dist/index.d.mts

@@ -177,10 +177,10 @@ declare function evaluateBaseAccess(resourcePath: string, session: AgriCoreSessi
  */
 declare function resolveEffectiveAccess(base: AccessLevelType, override?: AccessLevelType | null): AccessLevelType;
 declare function findSpecificOverride(session: AgriCoreSession, activeScopeId: string, resourcePath: string): AccessLevelType | null;
-declare function assertTenantBoundary(db: any, session: AgriCoreSession, // Pass the JWT session instead of just requesterCompanyId
-targets: {
+declare function assertTenantBoundary(db: any, session: AgriCoreSession, targets: {
     targetUserId?: string;
     authScopeId?: string;
+    authScopeIds?: string[];
     expectedScopeType?: ScopeType;
 }): Promise<boolean>;
 declare function verifyAndExtractSession(token: string, secret: string): Promise<AgriCoreSession>;

package/dist/index.d.ts

@@ -177,10 +177,10 @@ declare function evaluateBaseAccess(resourcePath: string, session: AgriCoreSessi
  */
 declare function resolveEffectiveAccess(base: AccessLevelType, override?: AccessLevelType | null): AccessLevelType;
 declare function findSpecificOverride(session: AgriCoreSession, activeScopeId: string, resourcePath: string): AccessLevelType | null;
-declare function assertTenantBoundary(db: any, session: AgriCoreSession, // Pass the JWT session instead of just requesterCompanyId
-targets: {
+declare function assertTenantBoundary(db: any, session: AgriCoreSession, targets: {
     targetUserId?: string;
     authScopeId?: string;
+    authScopeIds?: string[];
     expectedScopeType?: ScopeType;
 }): Promise<boolean>;
 declare function verifyAndExtractSession(token: string, secret: string): Promise<AgriCoreSession>;

package/dist/index.js

@@ -400,7 +400,7 @@ function createBase44PricingAdapter(db, scope) {
           productId,
           contractReferenceNumber,
           matrixType: "procurement_buy",
-          validFrom_lte: targetIso
+          validFrom: { $lte: targetIso }
         },
         SORT_MOST_RECENT_FIRST,
         ACTIVE_ROW_LOOKBACK
@@ -412,7 +412,7 @@ function createBase44PricingAdapter(db, scope) {
     async findAccountPrice({ productId, accountCode, targetDate }) {
       const targetIso = targetDate.toISOString();
       const rows = await db.ProductPriceMatrix.filter(
-        { ...scopeFilter, productId, accountCode, validFrom_lte: targetIso },
+        { ...scopeFilter, productId, accountCode, validFrom: { $lte: targetIso } },
         SORT_MOST_RECENT_FIRST,
         ACTIVE_ROW_LOOKBACK
       );
@@ -421,7 +421,7 @@ function createBase44PricingAdapter(db, scope) {
     async findDefaultPrice({ productId, targetDate }) {
       const targetIso = targetDate.toISOString();
       const rows = await db.ProductPriceMatrix.filter(
-        { ...scopeFilter, productId, accountCode: "INTERNAL_DEFAULT", validFrom_lte: targetIso },
+        { ...scopeFilter, productId, accountCode: "INTERNAL_DEFAULT", validFrom: { $lte: targetIso } },
         SORT_MOST_RECENT_FIRST,
         ACTIVE_ROW_LOOKBACK
       );
@@ -1870,6 +1870,19 @@ async function assertTenantBoundary(db, session, targets) {
       throw ErrorFactory.forbidden(MOD.ADMIN, ACT.EDIT, "Invalid authorization scope level.");
     }
   }
+  if (targets.authScopeIds?.length) {
+    const matchedScope = session.availableScopes?.find(
+      (scope) => targets.authScopeIds.includes(scope.authScopeId)
+    );
+    if (!matchedScope) {
+      console.error(`[SECURITY BREACH] None of scopes [${targets.authScopeIds.join(", ")}] found in user's permitted list.`);
+      throw ErrorFactory.forbidden(MOD.ADMIN, ACT.EDIT, "Tenant boundary violation.");
+    }
+    if (targets.expectedScopeType && matchedScope.type !== targets.expectedScopeType) {
+      console.error(`[VALIDATION ERROR] Expected type ${targets.expectedScopeType} but got ${matchedScope.type}`);
+      throw ErrorFactory.forbidden(MOD.ADMIN, ACT.EDIT, "Invalid authorization scope level.");
+    }
+  }
   return true;
 }
 async function verifyAndExtractSession(token, secret) {

package/dist/index.mjs

@@ -340,7 +340,7 @@ function createBase44PricingAdapter(db, scope) {
           productId,
           contractReferenceNumber,
           matrixType: "procurement_buy",
-          validFrom_lte: targetIso
+          validFrom: { $lte: targetIso }
         },
         SORT_MOST_RECENT_FIRST,
         ACTIVE_ROW_LOOKBACK
@@ -352,7 +352,7 @@ function createBase44PricingAdapter(db, scope) {
     async findAccountPrice({ productId, accountCode, targetDate }) {
       const targetIso = targetDate.toISOString();
       const rows = await db.ProductPriceMatrix.filter(
-        { ...scopeFilter, productId, accountCode, validFrom_lte: targetIso },
+        { ...scopeFilter, productId, accountCode, validFrom: { $lte: targetIso } },
         SORT_MOST_RECENT_FIRST,
         ACTIVE_ROW_LOOKBACK
       );
@@ -361,7 +361,7 @@ function createBase44PricingAdapter(db, scope) {
     async findDefaultPrice({ productId, targetDate }) {
       const targetIso = targetDate.toISOString();
       const rows = await db.ProductPriceMatrix.filter(
-        { ...scopeFilter, productId, accountCode: "INTERNAL_DEFAULT", validFrom_lte: targetIso },
+        { ...scopeFilter, productId, accountCode: "INTERNAL_DEFAULT", validFrom: { $lte: targetIso } },
         SORT_MOST_RECENT_FIRST,
         ACTIVE_ROW_LOOKBACK
       );
@@ -851,6 +851,19 @@ async function assertTenantBoundary(db, session, targets) {
       throw ErrorFactory.forbidden(MOD.ADMIN, ACT.EDIT, "Invalid authorization scope level.");
     }
   }
+  if (targets.authScopeIds?.length) {
+    const matchedScope = session.availableScopes?.find(
+      (scope) => targets.authScopeIds.includes(scope.authScopeId)
+    );
+    if (!matchedScope) {
+      console.error(`[SECURITY BREACH] None of scopes [${targets.authScopeIds.join(", ")}] found in user's permitted list.`);
+      throw ErrorFactory.forbidden(MOD.ADMIN, ACT.EDIT, "Tenant boundary violation.");
+    }
+    if (targets.expectedScopeType && matchedScope.type !== targets.expectedScopeType) {
+      console.error(`[VALIDATION ERROR] Expected type ${targets.expectedScopeType} but got ${matchedScope.type}`);
+      throw ErrorFactory.forbidden(MOD.ADMIN, ACT.EDIT, "Invalid authorization scope level.");
+    }
+  }
   return true;
 }
 async function verifyAndExtractSession(token, secret) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@litusarchieve18/agricore-utils",
-  "version": "1.0.28",
+  "version": "1.0.30",
   "description": "Canonical Backend Utility Library for AgriCore",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",