@litusarchieve18/agricore-utils 1.0.5 → 1.0.6

package/dist/index.d.mts

@@ -506,7 +506,8 @@ declare function evaluateBaseAccess(resourcePath: string, session: {
 declare function assertTenantBoundary(db: any, requesterCompanyId: string, targets: {
     targetUserId?: string;
     authScopeId?: string;
+    expectedScopeType?: 'company' | 'legalEntity' | 'facility';
 }): Promise<boolean>;
-declare function resolveEffectiveAccess(base: AccessLevelType, override?: AccessLevelType): AccessLevelType;
+declare function resolveEffectiveAccess(base: AccessLevelType, override?: AccessLevelType | null): AccessLevelType;
 
 export { ACCESS_RANK, ACT, AccessLevel, type AccessLevelType, type AgriCoreSession, AgriLogger, AppError, ApprovalStatus, ApprovalType, AuditStatus, AuditType, type AuthScopeFields, type AvailableScope, CAT, type CompanyConfig, Converter, CropCycleStatus, ERROR_DICTIONARY, EmitterType, EnabledModule, ErrorFactory, FORM_REGISTRY, FacilityType, type FormMeta, HarvestMethod, type InfrastructureFields, LinkedStatus, MOD, MODULE_LABELS, MicroclimateZone, MimeType, type ModCode, NettingType, NotificationMode, OrderStatus, type PermissionLevel, PhysicalState, PlantingMethod, RESOURCE_PATHS, ROLE_SECTIONS_BY_KEY, RelationshipType, type ResolvedError, type ResourceOverrides, RowOrientation, SENTINEL_UUID, type ScopeType, SoilTexture, TASK_TYPE_REGISTRY, type TabConfig, TargetEntityType, TaskStatus, TaskType, type TaskTypeConfig, TransactionType, TrellisType, UserPrivilege, UserRole, type UserRoleType, Validator, VigorRating, WaterSource, assertCanWrite, assertTenantBoundary, buildRlsFilter, canRead, canWrite, evaluateBaseAccess, extractAppCode, generateCanonicalId, generateInfrastructureFields, getAcceptedMimeTypes, getApproveAction, getFormMeta, getFormsGroupedByModule, getTaskTypeOptions, handleAppErrorResponse, isTabVisible, isTabWritable, resolveAccess, resolveAppError, resolveEffectiveAccess, resolveError, resolveMenuVisibility, withAgriLogging };

package/dist/index.d.ts

@@ -506,7 +506,8 @@ declare function evaluateBaseAccess(resourcePath: string, session: {
 declare function assertTenantBoundary(db: any, requesterCompanyId: string, targets: {
     targetUserId?: string;
     authScopeId?: string;
+    expectedScopeType?: 'company' | 'legalEntity' | 'facility';
 }): Promise<boolean>;
-declare function resolveEffectiveAccess(base: AccessLevelType, override?: AccessLevelType): AccessLevelType;
+declare function resolveEffectiveAccess(base: AccessLevelType, override?: AccessLevelType | null): AccessLevelType;
 
 export { ACCESS_RANK, ACT, AccessLevel, type AccessLevelType, type AgriCoreSession, AgriLogger, AppError, ApprovalStatus, ApprovalType, AuditStatus, AuditType, type AuthScopeFields, type AvailableScope, CAT, type CompanyConfig, Converter, CropCycleStatus, ERROR_DICTIONARY, EmitterType, EnabledModule, ErrorFactory, FORM_REGISTRY, FacilityType, type FormMeta, HarvestMethod, type InfrastructureFields, LinkedStatus, MOD, MODULE_LABELS, MicroclimateZone, MimeType, type ModCode, NettingType, NotificationMode, OrderStatus, type PermissionLevel, PhysicalState, PlantingMethod, RESOURCE_PATHS, ROLE_SECTIONS_BY_KEY, RelationshipType, type ResolvedError, type ResourceOverrides, RowOrientation, SENTINEL_UUID, type ScopeType, SoilTexture, TASK_TYPE_REGISTRY, type TabConfig, TargetEntityType, TaskStatus, TaskType, type TaskTypeConfig, TransactionType, TrellisType, UserPrivilege, UserRole, type UserRoleType, Validator, VigorRating, WaterSource, assertCanWrite, assertTenantBoundary, buildRlsFilter, canRead, canWrite, evaluateBaseAccess, extractAppCode, generateCanonicalId, generateInfrastructureFields, getAcceptedMimeTypes, getApproveAction, getFormMeta, getFormsGroupedByModule, getTaskTypeOptions, handleAppErrorResponse, isTabVisible, isTabWritable, resolveAccess, resolveAppError, resolveEffectiveAccess, resolveError, resolveMenuVisibility, withAgriLogging };

package/dist/index.js

@@ -887,23 +887,29 @@ async function assertTenantBoundary(db, requesterCompanyId, targets) {
     }
   }
   if (targets.authScopeId) {
-    const [companyMatch, leMatch, facMatch] = await Promise.all([
-      db.Company.filter({ canonicalId: targets.authScopeId, id: requesterCompanyId }),
-      // Base44 id must match requester
-      db.LegalEntity.filter({ canonicalId: targets.authScopeId, companyId: requesterCompanyId }),
-      db.Facility.filter({ canonicalId: targets.authScopeId, companyId: requesterCompanyId })
-    ]);
-    const isValidScope = companyMatch.length > 0 || leMatch.length > 0 || facMatch.length > 0;
-    if (!isValidScope) {
-      console.error(`[SECURITY BREACH ATTEMPT] User tried to assign scope ${targets.authScopeId} outside company ${requesterCompanyId}`);
-      throw ErrorFactory.forbidden(MOD.ADMIN, ACT.EDIT, "Invalid authorization scope or tenant boundary violation.");
+    let matchFound = false;
+    if (targets.expectedScopeType === "company" || !targets.expectedScopeType) {
+      const c = await db.Company.filter({ canonicalId: targets.authScopeId, id: requesterCompanyId });
+      if (c.length > 0) matchFound = true;
+    }
+    if (!matchFound && (targets.expectedScopeType === "legalEntity" || !targets.expectedScopeType)) {
+      const le = await db.LegalEntity.filter({ canonicalId: targets.authScopeId, companyId: requesterCompanyId });
+      if (le.length > 0) matchFound = true;
+    }
+    if (!matchFound && (targets.expectedScopeType === "facility" || !targets.expectedScopeType)) {
+      const fac = await db.Facility.filter({ canonicalId: targets.authScopeId, companyId: requesterCompanyId });
+      if (fac.length > 0) matchFound = true;
+    }
+    if (!matchFound) {
+      console.error(`[SECURITY BREACH/VALIDATION ERROR] Scope ${targets.authScopeId} not found for type ${targets.expectedScopeType} in company ${requesterCompanyId}`);
+      throw ErrorFactory.forbidden(MOD.ADMIN, ACT.EDIT, "Invalid authorization scope level or tenant boundary violation.");
     }
   }
   return true;
 }
 function resolveEffectiveAccess(base, override) {
-  if (!override) return base;
-  return ACCESS_RANK[override] >= ACCESS_RANK[base] ? override : base;
+  if (override === void 0 || override === null) return base;
+  return override;
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/index.mjs

@@ -793,23 +793,29 @@ async function assertTenantBoundary(db, requesterCompanyId, targets) {
     }
   }
   if (targets.authScopeId) {
-    const [companyMatch, leMatch, facMatch] = await Promise.all([
-      db.Company.filter({ canonicalId: targets.authScopeId, id: requesterCompanyId }),
-      // Base44 id must match requester
-      db.LegalEntity.filter({ canonicalId: targets.authScopeId, companyId: requesterCompanyId }),
-      db.Facility.filter({ canonicalId: targets.authScopeId, companyId: requesterCompanyId })
-    ]);
-    const isValidScope = companyMatch.length > 0 || leMatch.length > 0 || facMatch.length > 0;
-    if (!isValidScope) {
-      console.error(`[SECURITY BREACH ATTEMPT] User tried to assign scope ${targets.authScopeId} outside company ${requesterCompanyId}`);
-      throw ErrorFactory.forbidden(MOD.ADMIN, ACT.EDIT, "Invalid authorization scope or tenant boundary violation.");
+    let matchFound = false;
+    if (targets.expectedScopeType === "company" || !targets.expectedScopeType) {
+      const c = await db.Company.filter({ canonicalId: targets.authScopeId, id: requesterCompanyId });
+      if (c.length > 0) matchFound = true;
+    }
+    if (!matchFound && (targets.expectedScopeType === "legalEntity" || !targets.expectedScopeType)) {
+      const le = await db.LegalEntity.filter({ canonicalId: targets.authScopeId, companyId: requesterCompanyId });
+      if (le.length > 0) matchFound = true;
+    }
+    if (!matchFound && (targets.expectedScopeType === "facility" || !targets.expectedScopeType)) {
+      const fac = await db.Facility.filter({ canonicalId: targets.authScopeId, companyId: requesterCompanyId });
+      if (fac.length > 0) matchFound = true;
+    }
+    if (!matchFound) {
+      console.error(`[SECURITY BREACH/VALIDATION ERROR] Scope ${targets.authScopeId} not found for type ${targets.expectedScopeType} in company ${requesterCompanyId}`);
+      throw ErrorFactory.forbidden(MOD.ADMIN, ACT.EDIT, "Invalid authorization scope level or tenant boundary violation.");
     }
   }
   return true;
 }
 function resolveEffectiveAccess(base, override) {
-  if (!override) return base;
-  return ACCESS_RANK[override] >= ACCESS_RANK[base] ? override : base;
+  if (override === void 0 || override === null) return base;
+  return override;
 }
 export {
   ACCESS_RANK,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@litusarchieve18/agricore-utils",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "description": "Canonical Backend Utility Library for AgriCore",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",