@litusarchieve18/agricore-utils 1.0.29 → 1.0.30

package/README.md

@@ -183,6 +183,8 @@ Run the publish command:
 Bash
 npm publish --access public
 📝 Version History
+V1.0.30 — altered authscoped Id to receive a list of string not a single string
+
 V1.0.29 — altered filtering logic from validFrom_lte: targetIso to validFrom: { $lte: targetIso }
 
 V1.0.28 — altered the logic and added scope aware filtering and write-time validation in priceHelpers.ts

package/dist/index.d.mts

@@ -177,10 +177,10 @@ declare function evaluateBaseAccess(resourcePath: string, session: AgriCoreSessi
  */
 declare function resolveEffectiveAccess(base: AccessLevelType, override?: AccessLevelType | null): AccessLevelType;
 declare function findSpecificOverride(session: AgriCoreSession, activeScopeId: string, resourcePath: string): AccessLevelType | null;
-declare function assertTenantBoundary(db: any, session: AgriCoreSession, // Pass the JWT session instead of just requesterCompanyId
-targets: {
+declare function assertTenantBoundary(db: any, session: AgriCoreSession, targets: {
     targetUserId?: string;
     authScopeId?: string;
+    authScopeIds?: string[];
     expectedScopeType?: ScopeType;
 }): Promise<boolean>;
 declare function verifyAndExtractSession(token: string, secret: string): Promise<AgriCoreSession>;

package/dist/index.d.ts

@@ -177,10 +177,10 @@ declare function evaluateBaseAccess(resourcePath: string, session: AgriCoreSessi
  */
 declare function resolveEffectiveAccess(base: AccessLevelType, override?: AccessLevelType | null): AccessLevelType;
 declare function findSpecificOverride(session: AgriCoreSession, activeScopeId: string, resourcePath: string): AccessLevelType | null;
-declare function assertTenantBoundary(db: any, session: AgriCoreSession, // Pass the JWT session instead of just requesterCompanyId
-targets: {
+declare function assertTenantBoundary(db: any, session: AgriCoreSession, targets: {
     targetUserId?: string;
     authScopeId?: string;
+    authScopeIds?: string[];
     expectedScopeType?: ScopeType;
 }): Promise<boolean>;
 declare function verifyAndExtractSession(token: string, secret: string): Promise<AgriCoreSession>;

package/dist/index.js

@@ -1870,6 +1870,19 @@ async function assertTenantBoundary(db, session, targets) {
       throw ErrorFactory.forbidden(MOD.ADMIN, ACT.EDIT, "Invalid authorization scope level.");
     }
   }
+  if (targets.authScopeIds?.length) {
+    const matchedScope = session.availableScopes?.find(
+      (scope) => targets.authScopeIds.includes(scope.authScopeId)
+    );
+    if (!matchedScope) {
+      console.error(`[SECURITY BREACH] None of scopes [${targets.authScopeIds.join(", ")}] found in user's permitted list.`);
+      throw ErrorFactory.forbidden(MOD.ADMIN, ACT.EDIT, "Tenant boundary violation.");
+    }
+    if (targets.expectedScopeType && matchedScope.type !== targets.expectedScopeType) {
+      console.error(`[VALIDATION ERROR] Expected type ${targets.expectedScopeType} but got ${matchedScope.type}`);
+      throw ErrorFactory.forbidden(MOD.ADMIN, ACT.EDIT, "Invalid authorization scope level.");
+    }
+  }
   return true;
 }
 async function verifyAndExtractSession(token, secret) {

package/dist/index.mjs

@@ -851,6 +851,19 @@ async function assertTenantBoundary(db, session, targets) {
       throw ErrorFactory.forbidden(MOD.ADMIN, ACT.EDIT, "Invalid authorization scope level.");
     }
   }
+  if (targets.authScopeIds?.length) {
+    const matchedScope = session.availableScopes?.find(
+      (scope) => targets.authScopeIds.includes(scope.authScopeId)
+    );
+    if (!matchedScope) {
+      console.error(`[SECURITY BREACH] None of scopes [${targets.authScopeIds.join(", ")}] found in user's permitted list.`);
+      throw ErrorFactory.forbidden(MOD.ADMIN, ACT.EDIT, "Tenant boundary violation.");
+    }
+    if (targets.expectedScopeType && matchedScope.type !== targets.expectedScopeType) {
+      console.error(`[VALIDATION ERROR] Expected type ${targets.expectedScopeType} but got ${matchedScope.type}`);
+      throw ErrorFactory.forbidden(MOD.ADMIN, ACT.EDIT, "Invalid authorization scope level.");
+    }
+  }
   return true;
 }
 async function verifyAndExtractSession(token, secret) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@litusarchieve18/agricore-utils",
-  "version": "1.0.29",
+  "version": "1.0.30",
   "description": "Canonical Backend Utility Library for AgriCore",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",