@medusajs/framework 2.22.1 → 2.22.2-snapshot-20261026132527
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/http/index.d.ts +2 -0
- package/dist/http/index.d.ts.map +1 -1
- package/dist/http/index.js +2 -0
- package/dist/http/index.js.map +1 -1
- package/dist/http/middleware-file-loader.d.ts.map +1 -1
- package/dist/http/middleware-file-loader.js +6 -15
- package/dist/http/middleware-file-loader.js.map +1 -1
- package/dist/http/middlewares/authorize.d.ts +43 -0
- package/dist/http/middlewares/authorize.d.ts.map +1 -0
- package/dist/http/middlewares/authorize.js +89 -0
- package/dist/http/middlewares/authorize.js.map +1 -0
- package/dist/http/middlewares/index.d.ts +1 -1
- package/dist/http/middlewares/index.d.ts.map +1 -1
- package/dist/http/middlewares/index.js +1 -1
- package/dist/http/middlewares/index.js.map +1 -1
- package/dist/http/router.d.ts.map +1 -1
- package/dist/http/router.js +20 -15
- package/dist/http/router.js.map +1 -1
- package/dist/http/routes-loader.d.ts.map +1 -1
- package/dist/http/routes-loader.js +9 -1
- package/dist/http/routes-loader.js.map +1 -1
- package/dist/http/types.d.ts +7 -159
- package/dist/http/types.d.ts.map +1 -1
- package/dist/http/types.js.map +1 -1
- package/dist/http/utils/build-authz-context.d.ts +16 -0
- package/dist/http/utils/build-authz-context.d.ts.map +1 -0
- package/dist/http/utils/build-authz-context.js +44 -0
- package/dist/http/utils/build-authz-context.js.map +1 -0
- package/dist/http/utils/get-query-config.d.ts +3 -4
- package/dist/http/utils/get-query-config.d.ts.map +1 -1
- package/dist/http/utils/get-query-config.js +11 -4
- package/dist/http/utils/get-query-config.js.map +1 -1
- package/dist/http/utils/policies/rbac-field-filter.d.ts +3 -6
- package/dist/http/utils/policies/rbac-field-filter.d.ts.map +1 -1
- package/dist/http/utils/policies/rbac-field-filter.js +7 -6
- package/dist/http/utils/policies/rbac-field-filter.js.map +1 -1
- package/dist/http/utils/resolve-roles.d.ts +13 -0
- package/dist/http/utils/resolve-roles.d.ts.map +1 -0
- package/dist/http/utils/resolve-roles.js +42 -0
- package/dist/http/utils/resolve-roles.js.map +1 -0
- package/dist/policies/has-permission.d.ts +26 -0
- package/dist/policies/has-permission.d.ts.map +1 -1
- package/dist/policies/has-permission.js +69 -9
- package/dist/policies/has-permission.js.map +1 -1
- package/dist/policies/index.d.ts +0 -1
- package/dist/policies/index.d.ts.map +1 -1
- package/dist/policies/index.js +0 -1
- package/dist/policies/index.js.map +1 -1
- package/package.json +10 -10
- package/dist/http/middlewares/check-permissions.d.ts +0 -15
- package/dist/http/middlewares/check-permissions.d.ts.map +0 -1
- package/dist/http/middlewares/check-permissions.js +0 -54
- package/dist/http/middlewares/check-permissions.js.map +0 -1
- package/dist/policies/policy-loader.d.ts +0 -6
- package/dist/policies/policy-loader.d.ts.map +0 -1
- package/dist/policies/policy-loader.js +0 -17
- package/dist/policies/policy-loader.js.map +0 -1
package/dist/http/types.d.ts
CHANGED
|
@@ -1,9 +1,11 @@
|
|
|
1
1
|
import type { ZodNullable, ZodObject, ZodOptional, ZodRawShape } from "@medusajs/deps/zod";
|
|
2
|
-
import type {
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
2
|
+
import type { MedusaNextFunction, MedusaRequest, MedusaRequestHandler, MedusaResponse } from "@medusajs/types";
|
|
3
|
+
/**
|
|
4
|
+
* The HTTP request/response types were moved to`@medusajs/types`.
|
|
5
|
+
* They are re-exported here to keep `@medusajs/framework/http` import paths
|
|
6
|
+
* working.
|
|
7
|
+
*/
|
|
8
|
+
export type { AuthContext, AuthenticatedMedusaRequest, MedusaNextFunction, MedusaRequest, MedusaRequestHandler, MedusaResponse, MedusaStoreRequest, PublishableKeyContext, RestrictedFieldsSet, SecretKeyContext, } from "@medusajs/types";
|
|
7
9
|
/**
|
|
8
10
|
* List of all the supported HTTP methods
|
|
9
11
|
*/
|
|
@@ -30,14 +32,6 @@ export type MiddlewareRoute = {
|
|
|
30
32
|
bodyParser?: ParserConfig;
|
|
31
33
|
additionalDataValidator?: ZodRawShape;
|
|
32
34
|
middlewares?: MiddlewareFunction[];
|
|
33
|
-
/** @ignore */
|
|
34
|
-
policies?: {
|
|
35
|
-
resource: string;
|
|
36
|
-
operation: string;
|
|
37
|
-
} | Array<{
|
|
38
|
-
resource: string;
|
|
39
|
-
operation: string | string[];
|
|
40
|
-
}>;
|
|
41
35
|
};
|
|
42
36
|
export type MiddlewaresConfig = {
|
|
43
37
|
errorHandler?: false | MedusaErrorHandlerFunction;
|
|
@@ -68,13 +62,6 @@ export type MiddlewareDescriptor = {
|
|
|
68
62
|
matcher: string | RegExp;
|
|
69
63
|
methods?: MiddlewareVerb | MiddlewareVerb[];
|
|
70
64
|
handler: MiddlewareFunction;
|
|
71
|
-
policies?: {
|
|
72
|
-
resource: string;
|
|
73
|
-
operation: string;
|
|
74
|
-
} | Array<{
|
|
75
|
-
resource: string;
|
|
76
|
-
operation: string | string[];
|
|
77
|
-
}>;
|
|
78
65
|
};
|
|
79
66
|
export type BodyParserConfigRoute = {
|
|
80
67
|
matcher: string | RegExp;
|
|
@@ -90,143 +77,4 @@ export type AdditionalDataValidatorRoute = {
|
|
|
90
77
|
export type GlobalMiddlewareDescriptor = {
|
|
91
78
|
config?: MiddlewaresConfig;
|
|
92
79
|
};
|
|
93
|
-
export interface MedusaRequest<Body = unknown, QueryFields = Record<string, unknown>> extends Request<{
|
|
94
|
-
[key: string]: string;
|
|
95
|
-
}, any, Body> {
|
|
96
|
-
validatedBody: Body;
|
|
97
|
-
validatedQuery: RequestQueryFields & QueryFields;
|
|
98
|
-
/**
|
|
99
|
-
* TODO: shouldn't this correspond to returnable fields instead of allowed fields? also it is used by the cleanResponseData util
|
|
100
|
-
*/
|
|
101
|
-
allowedProperties: string[];
|
|
102
|
-
/**
|
|
103
|
-
* An object containing the select, relation, skip, take and order to be used with medusa internal services
|
|
104
|
-
*/
|
|
105
|
-
listConfig: FindConfig<unknown>;
|
|
106
|
-
/**
|
|
107
|
-
* An object containing the select, relation to be used with medusa internal services
|
|
108
|
-
*/
|
|
109
|
-
retrieveConfig: FindConfig<unknown>;
|
|
110
|
-
/**
|
|
111
|
-
* An object containing fields and variables to be used with the remoteQuery
|
|
112
|
-
*
|
|
113
|
-
* @since 2.2.0
|
|
114
|
-
*/
|
|
115
|
-
queryConfig: {
|
|
116
|
-
fields: string[];
|
|
117
|
-
pagination: {
|
|
118
|
-
order?: Record<string, string>;
|
|
119
|
-
skip: number;
|
|
120
|
-
take?: number;
|
|
121
|
-
};
|
|
122
|
-
withDeleted?: boolean;
|
|
123
|
-
};
|
|
124
|
-
/**
|
|
125
|
-
* @deprecated Use {@link queryConfig} instead.
|
|
126
|
-
*/
|
|
127
|
-
remoteQueryConfig: MedusaRequest["queryConfig"];
|
|
128
|
-
/**
|
|
129
|
-
* An object containing the fields that are filterable e.g `{ id: Any<String> }`
|
|
130
|
-
*/
|
|
131
|
-
filterableFields: QueryFields;
|
|
132
|
-
includes?: Record<string, boolean>;
|
|
133
|
-
/**
|
|
134
|
-
* An array of fields and relations that are allowed to be queried, this can be set by the
|
|
135
|
-
* consumer as part of a middleware and it will take precedence over the req.allowed set
|
|
136
|
-
* by the api
|
|
137
|
-
*
|
|
138
|
-
* Initialized per request, so add to it with `req.allowed.push(field)` — several
|
|
139
|
-
* middlewares can each contribute that way. Reassigning the array discards what other
|
|
140
|
-
* middlewares granted. To disallow an allowed field use {@link disallowed}, which is
|
|
141
|
-
* applied after this list.
|
|
142
|
-
*/
|
|
143
|
-
allowed: string[];
|
|
144
|
-
/**
|
|
145
|
-
* An array of fields and relations that must never be resolved, this can be set by the
|
|
146
|
-
* consumer as part of a global middleware and it replaces the disallowed fields
|
|
147
|
-
* configured by the route's query configuration
|
|
148
|
-
*
|
|
149
|
-
* Since disallowed fields are a security boundary that keeps sensitive relations off an
|
|
150
|
-
* endpoint, set this to the route's configured fields minus the ones you need, rather
|
|
151
|
-
* than to a short list of your own. An empty array removes the boundary entirely.
|
|
152
|
-
*
|
|
153
|
-
* @since v2.21.0
|
|
154
|
-
*/
|
|
155
|
-
disallowed?: (string | RegExp)[];
|
|
156
|
-
errors: string[];
|
|
157
|
-
scope: MedusaContainer;
|
|
158
|
-
session?: any;
|
|
159
|
-
rawBody?: any;
|
|
160
|
-
requestId?: string;
|
|
161
|
-
restrictedFields?: RestrictedFields;
|
|
162
|
-
/**
|
|
163
|
-
* The maximum number of relations that can be expanded by the request. It is only set for
|
|
164
|
-
* routes under the `/store` prefix, and can be overridden by a route's query configuration.
|
|
165
|
-
*
|
|
166
|
-
* @since v2.20.0
|
|
167
|
-
*/
|
|
168
|
-
storeRelationsLimit?: number;
|
|
169
|
-
/**
|
|
170
|
-
* An object that carries the context that is used to calculate prices for variants
|
|
171
|
-
*/
|
|
172
|
-
pricingContext?: MedusaPricingContext;
|
|
173
|
-
/**
|
|
174
|
-
* A generic context object that can be used across the request lifecycle
|
|
175
|
-
*/
|
|
176
|
-
context?: Record<string, any>;
|
|
177
|
-
/**
|
|
178
|
-
* Custom validator to validate the `additional_data` property in
|
|
179
|
-
* requests that allows for additional_data
|
|
180
|
-
*/
|
|
181
|
-
additionalDataValidator?: ZodOptional<ZodNullable<ZodObject<any, any>>>;
|
|
182
|
-
/**
|
|
183
|
-
* The locale for the current request, resolved from:
|
|
184
|
-
* 1. Query parameter `?locale=`
|
|
185
|
-
* 2. x-medusa-locale header
|
|
186
|
-
* 3. Store's default locale
|
|
187
|
-
*/
|
|
188
|
-
locale?: string;
|
|
189
|
-
}
|
|
190
|
-
export interface AuthContext {
|
|
191
|
-
actor_id: string;
|
|
192
|
-
actor_type: string;
|
|
193
|
-
auth_identity_id: string;
|
|
194
|
-
auth_provider?: string;
|
|
195
|
-
app_metadata: Record<string, unknown>;
|
|
196
|
-
user_metadata: Record<string, unknown>;
|
|
197
|
-
entity_id?: string;
|
|
198
|
-
purpose?: string;
|
|
199
|
-
jti?: string;
|
|
200
|
-
/**
|
|
201
|
-
* Whether the auth identity had an enabled MFA factor when the token was issued.
|
|
202
|
-
*/
|
|
203
|
-
mfa_enabled?: boolean;
|
|
204
|
-
/**
|
|
205
|
-
* When the MFA challenge was completed, or null when it has not been. Routes
|
|
206
|
-
* can require a recent completion to gate elevated actions.
|
|
207
|
-
*/
|
|
208
|
-
mfa_challenge_completed_at?: string | null;
|
|
209
|
-
}
|
|
210
|
-
export interface PublishableKeyContext {
|
|
211
|
-
key: string;
|
|
212
|
-
sales_channel_ids: string[];
|
|
213
|
-
}
|
|
214
|
-
export interface SecretKeyContext {
|
|
215
|
-
created_by: string;
|
|
216
|
-
}
|
|
217
|
-
export interface AuthenticatedMedusaRequest<Body = unknown, QueryFields = Record<string, unknown>> extends MedusaRequest<Body, QueryFields> {
|
|
218
|
-
auth_context: AuthContext;
|
|
219
|
-
publishable_key_context?: PublishableKeyContext;
|
|
220
|
-
secret_key_context?: SecretKeyContext;
|
|
221
|
-
policies?: PolicyAction[];
|
|
222
|
-
}
|
|
223
|
-
export interface MedusaStoreRequest<Body = unknown, QueryFields = Record<string, unknown>> extends MedusaRequest<Body, QueryFields> {
|
|
224
|
-
auth_context?: AuthContext;
|
|
225
|
-
publishable_key_context: PublishableKeyContext;
|
|
226
|
-
policies?: PolicyAction | PolicyAction[];
|
|
227
|
-
}
|
|
228
|
-
export type MedusaResponse<Body = unknown> = Response<Body>;
|
|
229
|
-
export type MedusaNextFunction = NextFunction;
|
|
230
|
-
export type MedusaRequestHandler<Body = unknown, Res = unknown> = (req: MedusaRequest<Body>, res: MedusaResponse<Res>, next: MedusaNextFunction) => Promise<void> | void;
|
|
231
|
-
export {};
|
|
232
80
|
//# sourceMappingURL=types.d.ts.map
|
package/dist/http/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/http/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,SAAS,EACT,WAAW,EACX,WAAW,EACZ,MAAM,oBAAoB,CAAA;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/http/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,SAAS,EACT,WAAW,EACX,WAAW,EACZ,MAAM,oBAAoB,CAAA;AAE3B,OAAO,KAAK,EACV,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,cAAc,EACf,MAAM,iBAAiB,CAAA;AAExB;;;;GAIG;AACH,YAAY,EACV,WAAW,EACX,0BAA0B,EAC1B,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,iBAAiB,CAAA;AAExB;;GAEG;AACH,eAAO,MAAM,YAAY,uEAQf,CAAA;AAEV,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAA;AACrD,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,CAAA;AAEtD,KAAK,gBAAgB,GAAG,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,CAAA;AAEzE,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,IAAI,CAAC,CAAA;AAElB,MAAM,MAAM,YAAY,GAAG,gBAAgB,GAAG,iBAAiB,CAAA;AAE/D,MAAM,MAAM,kBAAkB,GAC1B,oBAAoB,GACpB,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAA;AAE7B,MAAM,MAAM,0BAA0B,GAAG,CACvC,KAAK,EAAE,GAAG,EACV,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,kBAAkB,KACrB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;AAEzB,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IACvC,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,gBAAgB,CAAA;AAEnD,MAAM,MAAM,eAAe,GAAG;IAC5B;;OAEG;IACH,MAAM,CAAC,EAAE,cAAc,GAAG,cAAc,EAAE,CAAA;IAC1C,OAAO,CAAC,EAAE,cAAc,EAAE,CAAA;IAC1B,OAAO,EAAE,MAAM,GAAG,MAAM,CAAA;IACxB,UAAU,CAAC,EAAE,YAAY,CAAA;IACzB,uBAAuB,CAAC,EAAE,WAAW,CAAA;IACrC,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAA;CACnC,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,YAAY,CAAC,EAAE,KAAK,GAAG,0BAA0B,CAAA;IACjD,MAAM,CAAC,EAAE,eAAe,EAAE,CAAA;CAC3B,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,SAAS,CAAA;IACjB,OAAO,EAAE,YAAY,CAAA;IACrB,cAAc,EAAE,OAAO,CAAA;IACvB,OAAO,EAAE,IAAI,CAAA;IACb,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,CAAA;IACtC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,qBAAqB,EAAE,OAAO,CAAA;IAC9B,oBAAoB,EAAE,OAAO,CAAA;CAC9B,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAA;IACxB,OAAO,CAAC,EAAE,cAAc,GAAG,cAAc,EAAE,CAAA;IAC3C,OAAO,EAAE,kBAAkB,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAA;IACxB,OAAO,EAAE,cAAc,GAAG,cAAc,EAAE,CAAA;IAC1C,MAAM,EAAE,YAAY,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,4BAA4B,GAAG;IACzC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAA;IACxB,OAAO,EAAE,cAAc,GAAG,cAAc,EAAE,CAAA;IAC1C,MAAM,EAAE,WAAW,CAAA;IACnB,SAAS,EAAE,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;CACzD,CAAA;AAED,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,CAAC,EAAE,iBAAiB,CAAA;CAC3B,CAAA"}
|
package/dist/http/types.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/http/types.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/http/types.ts"],"names":[],"mappings":";;;AAgCA;;GAEG;AACU,QAAA,YAAY,GAAG;IAC1B,KAAK;IACL,MAAM;IACN,KAAK;IACL,OAAO;IACP,QAAQ;IACR,SAAS;IACT,MAAM;CACE,CAAA"}
|
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
import { AuthzContextConfig, MedusaContainer } from "@medusajs/types";
|
|
2
|
+
type AuthzContextInput = {
|
|
3
|
+
actor_type: string;
|
|
4
|
+
actor_id: string;
|
|
5
|
+
config: AuthzContextConfig;
|
|
6
|
+
container: MedusaContainer;
|
|
7
|
+
};
|
|
8
|
+
type AuthzContext = {
|
|
9
|
+
grantees: {
|
|
10
|
+
type: string;
|
|
11
|
+
id: string;
|
|
12
|
+
}[];
|
|
13
|
+
};
|
|
14
|
+
export declare function buildAuthzContext({ actor_type, actor_id, config, container, }: AuthzContextInput): Promise<AuthzContext>;
|
|
15
|
+
export {};
|
|
16
|
+
//# sourceMappingURL=build-authz-context.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"build-authz-context.d.ts","sourceRoot":"","sources":["../../../src/http/utils/build-authz-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAGrE,KAAK,iBAAiB,GAAG;IACvB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,kBAAkB,CAAA;IAC1B,SAAS,EAAE,eAAe,CAAA;CAC3B,CAAA;AAED,KAAK,YAAY,GAAG;IAClB,QAAQ,EAAE;QACR,IAAI,EAAE,MAAM,CAAA;QACZ,EAAE,EAAE,MAAM,CAAA;KACX,EAAE,CAAA;CACJ,CAAA;AA2BD,wBAAsB,iBAAiB,CAAC,EACtC,UAAU,EACV,QAAQ,EACR,MAAM,EACN,SAAS,GACV,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,CAAC,CAyB3C"}
|
|
@@ -0,0 +1,44 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.buildAuthzContext = buildAuthzContext;
|
|
4
|
+
const utils_1 = require("@medusajs/utils");
|
|
5
|
+
/**
|
|
6
|
+
* Walks `path` from `root`, flattening to-many relations (arrays) at any
|
|
7
|
+
* level, and returns every id reached. Null/missing intermediates are
|
|
8
|
+
* skipped; non-string leaves are dropped.
|
|
9
|
+
*/
|
|
10
|
+
const collect = (root, path) => {
|
|
11
|
+
const walk = (node, segments) => {
|
|
12
|
+
if (node == null) {
|
|
13
|
+
return [];
|
|
14
|
+
}
|
|
15
|
+
if (Array.isArray(node)) {
|
|
16
|
+
return node.flatMap((item) => walk(item, segments));
|
|
17
|
+
}
|
|
18
|
+
if (!segments.length) {
|
|
19
|
+
return [node];
|
|
20
|
+
}
|
|
21
|
+
const [head, ...rest] = segments;
|
|
22
|
+
return walk(node[head], rest);
|
|
23
|
+
};
|
|
24
|
+
return walk(root, path.split(".")).filter((value) => typeof value === "string");
|
|
25
|
+
};
|
|
26
|
+
async function buildAuthzContext({ actor_type, actor_id, config, container, }) {
|
|
27
|
+
const query = container.resolve(utils_1.ContainerRegistrationKeys.QUERY);
|
|
28
|
+
const fields = (0, utils_1.deduplicate)(config.grantees.map((grantee) => grantee.path));
|
|
29
|
+
const { data: [root], } = await query.graph({
|
|
30
|
+
entity: config.actor_entity ?? actor_type,
|
|
31
|
+
fields,
|
|
32
|
+
filters: { id: actor_id },
|
|
33
|
+
});
|
|
34
|
+
if (!root) {
|
|
35
|
+
return { grantees: [] };
|
|
36
|
+
}
|
|
37
|
+
return {
|
|
38
|
+
grantees: config.grantees.flatMap((grantee) => collect(root, grantee.path).map((id) => ({
|
|
39
|
+
type: grantee.entity,
|
|
40
|
+
id,
|
|
41
|
+
}))),
|
|
42
|
+
};
|
|
43
|
+
}
|
|
44
|
+
//# sourceMappingURL=build-authz-context.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"build-authz-context.js","sourceRoot":"","sources":["../../../src/http/utils/build-authz-context.ts"],"names":[],"mappings":";;AA0CA,8CA8BC;AAvED,2CAAwE;AAgBxE;;;;GAIG;AACH,MAAM,OAAO,GAAG,CAAC,IAAa,EAAE,IAAY,EAAY,EAAE;IACxD,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,QAAkB,EAAa,EAAE;QAC5D,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;YACjB,OAAO,EAAE,CAAA;QACX,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;QACrD,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,CAAA;QACf,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,QAAQ,CAAA;QAChC,OAAO,IAAI,CAAE,IAAgC,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAA;IAC5D,CAAC,CAAA;IAED,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CACvC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CACtD,CAAA;AACH,CAAC,CAAA;AAEM,KAAK,UAAU,iBAAiB,CAAC,EACtC,UAAU,EACV,QAAQ,EACR,MAAM,EACN,SAAS,GACS;IAClB,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,iCAAyB,CAAC,KAAK,CAAC,CAAA;IAEhE,MAAM,MAAM,GAAG,IAAA,mBAAW,EAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IAE1E,MAAM,EACJ,IAAI,EAAE,CAAC,IAAI,CAAC,GACb,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC,YAAY,IAAI,UAAU;QACzC,MAAM;QACN,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;KAC1B,CAAC,CAAA;IAEF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IACzB,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAC5C,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACvC,IAAI,EAAE,OAAO,CAAC,MAAM;YACpB,EAAE;SACH,CAAC,CAAC,CACJ;KACF,CAAA;AACH,CAAC"}
|
|
@@ -1,12 +1,11 @@
|
|
|
1
|
-
import { FindConfig, QueryConfig, RequestQueryFields } from "@medusajs/types";
|
|
2
|
-
import { PolicyDefinition } from "@medusajs/utils";
|
|
1
|
+
import { FindConfig, QueryConfig, RbacContext, RequestQueryFields } from "@medusajs/types";
|
|
3
2
|
import { AuthContext, MedusaRequest } from "../types";
|
|
4
3
|
export declare function pickByConfig<TModel>(obj: TModel | TModel[], config: FindConfig<TModel>): Partial<TModel> | Partial<TModel>[];
|
|
5
4
|
export declare function prepareListQuery<T extends RequestQueryFields, TEntity>(validated: T, queryConfig?: QueryConfig<TEntity> & {
|
|
6
5
|
restricted?: string[];
|
|
7
6
|
}, req?: MedusaRequest & {
|
|
8
|
-
policies?: PolicyDefinition[];
|
|
9
7
|
auth_context?: AuthContext;
|
|
8
|
+
rbac_context?: RbacContext;
|
|
10
9
|
}): Promise<{
|
|
11
10
|
listConfig: {
|
|
12
11
|
select: string[] | undefined;
|
|
@@ -34,8 +33,8 @@ export declare function prepareListQuery<T extends RequestQueryFields, TEntity>(
|
|
|
34
33
|
export declare function prepareRetrieveQuery<T extends RequestQueryFields, TEntity>(validated: T, queryConfig?: QueryConfig<TEntity> & {
|
|
35
34
|
restricted?: string[];
|
|
36
35
|
}, req?: MedusaRequest & {
|
|
37
|
-
policies?: PolicyDefinition[];
|
|
38
36
|
auth_context?: AuthContext;
|
|
37
|
+
rbac_context?: RbacContext;
|
|
39
38
|
}): Promise<{
|
|
40
39
|
retrieveConfig: {
|
|
41
40
|
select: string[] | undefined;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"get-query-config.d.ts","sourceRoot":"","sources":["../../../src/http/utils/get-query-config.ts"],"names":[],"mappings":"AAAA,OAAO,
|
|
1
|
+
{"version":3,"file":"get-query-config.d.ts","sourceRoot":"","sources":["../../../src/http/utils/get-query-config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,WAAW,EACX,WAAW,EACX,kBAAkB,EACnB,MAAM,iBAAiB,CAAA;AAYxB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAWrD,wBAAgB,YAAY,CAAC,MAAM,EACjC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,EACtB,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,GACzB,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAWrC;AAED,wBAAsB,gBAAgB,CAAC,CAAC,SAAS,kBAAkB,EAAE,OAAO,EAC1E,SAAS,EAAE,CAAC,EACZ,WAAW,GAAE,WAAW,CAAC,OAAO,CAAC,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,EAClE,GAAG,CAAC,EAAE,aAAa,GAAG;IACpB,YAAY,CAAC,EAAE,WAAW,CAAA;IAC1B,YAAY,CAAC,EAAE,WAAW,CAAA;CAC3B;;;;;;;;;;;;;;;;;;;;;;;GAiIF;AAED,wBAAsB,oBAAoB,CACxC,CAAC,SAAS,kBAAkB,EAC5B,OAAO,EAEP,SAAS,EAAE,CAAC,EACZ,WAAW,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,EAC9D,GAAG,CAAC,EAAE,aAAa,GAAG;IACpB,YAAY,CAAC,EAAE,WAAW,CAAA;IAC1B,YAAY,CAAC,EAAE,WAAW,CAAA;CAC3B;;;;;;;;;;GAmBF"}
|
|
@@ -3,9 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
3
3
|
exports.pickByConfig = pickByConfig;
|
|
4
4
|
exports.prepareListQuery = prepareListQuery;
|
|
5
5
|
exports.prepareRetrieveQuery = prepareRetrieveQuery;
|
|
6
|
+
const modules_sdk_1 = require("@medusajs/modules-sdk");
|
|
6
7
|
const utils_1 = require("@medusajs/utils");
|
|
7
8
|
const field_filtering_1 = require("./field-filtering");
|
|
8
9
|
const rbac_field_filter_1 = require("./policies/rbac-field-filter");
|
|
10
|
+
const resolve_roles_1 = require("./resolve-roles");
|
|
9
11
|
function pickByConfig(obj, config) {
|
|
10
12
|
const fields = [...(config.select ?? []), ...(config.relations ?? [])];
|
|
11
13
|
if (fields.length) {
|
|
@@ -23,12 +25,17 @@ async function prepareListQuery(validated, queryConfig = {}, req) {
|
|
|
23
25
|
const { order, fields, limit = defaultLimit, offset = 0, with_deleted, } = validated;
|
|
24
26
|
const parsedFields = field_filtering_1.FieldParser.parse(fields, defaults);
|
|
25
27
|
const { fields: allFields, starFields } = parsedFields;
|
|
26
|
-
const rbacFilterFieldsFeatureFlag = utils_1.FeatureFlag.isFeatureEnabled("rbac_filter_fields");
|
|
27
28
|
const filters = [];
|
|
28
|
-
if (req?.policies &&
|
|
29
|
+
if (req?.rbac_context?.policies?.length &&
|
|
30
|
+
req?.auth_context &&
|
|
31
|
+
entity &&
|
|
32
|
+
modules_sdk_1.MedusaModule.isInstalled(utils_1.Modules.RBAC)) {
|
|
29
33
|
filters.push(new rbac_field_filter_1.RBACFieldFilter({
|
|
30
|
-
|
|
31
|
-
|
|
34
|
+
getActorRoles: async () => (0, resolve_roles_1.resolveRoles)({
|
|
35
|
+
authContext: req.auth_context,
|
|
36
|
+
container: req.scope,
|
|
37
|
+
scope: req.rbac_context?.scope,
|
|
38
|
+
}),
|
|
32
39
|
container: req.scope,
|
|
33
40
|
}));
|
|
34
41
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"get-query-config.js","sourceRoot":"","sources":["../../../src/http/utils/get-query-config.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"get-query-config.js","sourceRoot":"","sources":["../../../src/http/utils/get-query-config.ts"],"names":[],"mappings":";;AA4BA,oCAcC;AAED,4CAuIC;AAED,oDA4BC;AA3MD,uDAAoD;AACpD,2CASwB;AAExB,uDAM0B;AAC1B,oEAA8D;AAC9D,mDAA8C;AAE9C,SAAgB,YAAY,CAC1B,GAAsB,EACtB,MAA0B;IAE1B,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAA;IAEtE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAQ,EAAC,CAAW,EAAE,MAAkB,CAAC,CAAC,CAAA;QAClE,CAAC;aAAM,CAAC;YACN,OAAO,IAAA,gBAAQ,EAAC,GAAa,EAAE,MAAkB,CAAC,CAAA;QACpD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAEM,KAAK,UAAU,gBAAgB,CACpC,SAAY,EACZ,cAAgE,EAAE,EAClE,GAGC;IAED,MAAM,EACJ,OAAO,GAAG,EAAE,EACZ,UAAU,GAAG,EAAE,EACf,UAAU,GAAG,EAAE,EACf,QAAQ,GAAG,EAAE,EACb,YAAY,GAAG,EAAE,EACjB,MAAM,EACN,MAAM,GACP,GAAG,WAAW,CAAA;IACf,MAAM,EACJ,KAAK,EACL,MAAM,EACN,KAAK,GAAG,YAAY,EACpB,MAAM,GAAG,CAAC,EACV,YAAY,GACb,GAAG,SAAS,CAAA;IAEb,MAAM,YAAY,GAAG,6BAAW,CAAC,KAAK,CAAC,MAAM,EAAE,QAAoB,CAAC,CAAA;IACpE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,YAAY,CAAA;IAEtD,MAAM,OAAO,GAAmB,EAAE,CAAA;IAElC,IACE,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM;QACnC,GAAG,EAAE,YAAY;QACjB,MAAM;QACN,0BAAY,CAAC,WAAW,CAAC,eAAO,CAAC,IAAI,CAAC,EACtC,CAAC;QACD,OAAO,CAAC,IAAI,CACV,IAAI,mCAAe,CAAC;YAClB,aAAa,EAAE,KAAK,IAAI,EAAE,CACxB,IAAA,4BAAY,EAAC;gBACX,WAAW,EAAE,GAAG,CAAC,YAAa;gBAC9B,SAAS,EAAE,GAAG,CAAC,KAAK;gBACpB,KAAK,EAAE,GAAG,CAAC,YAAY,EAAE,KAAK;aAC/B,CAAC;YACJ,SAAS,EAAE,GAAG,CAAC,KAAK;SACrB,CAAC,CACH,CAAA;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,IAAI,oCAAkB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;IACnD,CAAC;SAAM,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,IAAI,uCAAqB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAA;IACzD,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,IAAA,kBAAU,EACvC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAChB,CAAC,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAgB,EAAE,YAAY,EAAE,CAAC,CAClE,CACF,CAAA;IACD,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;IAE9D,gBAAgB,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACjC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACvB,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,0EAA0E;IAC1E,4EAA4E;IAC5E,kEAAkE;IAClE,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,gBAAgB,GAAG,IAAI,uCAAqB,CAAC;YACjD,UAAU;SACX,CAAC,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAgB,EAAE,YAAY,EAAE,CAAC,CAAA;QAElE,gBAAgB,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YACjC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACvB,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC1B,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,8DAA8D;IAC9D,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAA,oCAA4B,EACxD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CACtB,CAAA;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAEvE,8BAA8B;IAE9B,IAAI,OAAO,GAAgD,EAAE,CAAA;IAC7D,IAAI,IAAA,iBAAS,EAAC,KAAK,CAAC,EAAE,CAAC;QACrB,IAAI,UAAU,GAAG,KAAK,CAAA;QACtB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAC3B,OAAO,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;QACpC,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAA;QAC9B,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,mBAAW,CACnB,mBAAW,CAAC,KAAK,CAAC,YAAY,EAC9B,eAAe,UAAU,eAAe,CACzC,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,IAAA,iBAAS,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAA,kBAAU,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACvE,OAAO;QACL,UAAU,EAAE;YACV,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YAC1C,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC;YACnC,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,UAAU;YACjB,WAAW,EAAE,YAAY;SAC1B;QACD,iBAAiB,EAAE;YACjB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,qHAAqH;YACrH,MAAM,EAAE;gBACN,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;gBACxB,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;aAC/C;YACD,UAAU,EAAE,MAAM;gBAChB,CAAC,CAAC;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,KAAK;oBACX,KAAK,EAAE,UAAU;iBAClB;gBACH,CAAC,CAAC,EAAE;YACN,WAAW,EAAE,YAAY;SAC1B;KACF,CAAA;AACH,CAAC;AAEM,KAAK,UAAU,oBAAoB,CAIxC,SAAY,EACZ,WAA8D,EAC9D,GAGC;IAED,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,MAAM,gBAAgB,CAC9D,SAAS,EACT,WAAW,EACX,GAAG,CACJ,CAAA;IAED,OAAO;QACL,cAAc,EAAE;YACd,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC;QACD,iBAAiB,EAAE;YACjB,MAAM,EAAE,iBAAiB,CAAC,MAAM;YAChC,UAAU,EAAE,EAAE;YACd,WAAW,EAAE,iBAAiB,CAAC,WAAW;SAC3C;KACF,CAAA;AACH,CAAC"}
|
|
@@ -1,4 +1,3 @@
|
|
|
1
|
-
import { PolicyDefinition } from "@medusajs/framework/utils";
|
|
2
1
|
import type { MedusaContainer } from "@medusajs/types";
|
|
3
2
|
import { FieldFilterContext, IFieldFilter } from "../field-filtering/index";
|
|
4
3
|
/**
|
|
@@ -6,12 +5,10 @@ import { FieldFilterContext, IFieldFilter } from "../field-filtering/index";
|
|
|
6
5
|
* Optimized for parallel permission checks
|
|
7
6
|
*/
|
|
8
7
|
export declare class RBACFieldFilter implements IFieldFilter {
|
|
9
|
-
private
|
|
10
|
-
private userRoles;
|
|
8
|
+
private getActorRoles;
|
|
11
9
|
private container;
|
|
12
|
-
constructor({
|
|
13
|
-
|
|
14
|
-
userRoles: string[];
|
|
10
|
+
constructor({ getActorRoles, container, }: {
|
|
11
|
+
getActorRoles: () => Promise<string[]>;
|
|
15
12
|
container: MedusaContainer;
|
|
16
13
|
});
|
|
17
14
|
getNotAllowedFields(context: FieldFilterContext): Promise<string[]>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"rbac-field-filter.d.ts","sourceRoot":"","sources":["../../../../src/http/utils/policies/rbac-field-filter.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"rbac-field-filter.d.ts","sourceRoot":"","sources":["../../../../src/http/utils/policies/rbac-field-filter.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAKtD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAqY3E;;;GAGG;AACH,qBAAa,eAAgB,YAAW,YAAY;IAClD,OAAO,CAAC,aAAa,CAAyB;IAC9C,OAAO,CAAC,SAAS,CAAiB;gBAEtB,EACV,aAAa,EACb,SAAS,GACV,EAAE;QACD,aAAa,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;QACtC,SAAS,EAAE,eAAe,CAAA;KAC3B;IAKK,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAkE1E"}
|
|
@@ -288,28 +288,29 @@ function collectUniqueEntityPaths(entity, fields) {
|
|
|
288
288
|
* Optimized for parallel permission checks
|
|
289
289
|
*/
|
|
290
290
|
class RBACFieldFilter {
|
|
291
|
-
constructor({
|
|
292
|
-
this.
|
|
293
|
-
this.userRoles = userRoles;
|
|
291
|
+
constructor({ getActorRoles, container, }) {
|
|
292
|
+
this.getActorRoles = getActorRoles;
|
|
294
293
|
this.container = container;
|
|
295
294
|
}
|
|
296
295
|
async getNotAllowedFields(context) {
|
|
297
296
|
const { entity, parsedFields } = context;
|
|
298
297
|
const { fields, starFields } = parsedFields;
|
|
299
298
|
const fieldsToCheck = [...fields, ...Array.from(starFields)];
|
|
300
|
-
if (!fieldsToCheck.length || !
|
|
299
|
+
if (!fieldsToCheck.length || !entity) {
|
|
301
300
|
return [];
|
|
302
301
|
}
|
|
302
|
+
const actorRoles = await this.getActorRoles();
|
|
303
|
+
const policyResources = await (0, has_permission_1.fetchPolicyResources)(this.container);
|
|
303
304
|
const uniquePaths = collectUniqueEntityPaths(entity, fieldsToCheck);
|
|
304
305
|
const pathsNeedingCheck = [];
|
|
305
306
|
for (const [path, info] of uniquePaths) {
|
|
306
|
-
if (info.entityName &&
|
|
307
|
+
if (info.entityName && policyResources.has(info.entityName)) {
|
|
307
308
|
pathsNeedingCheck.push({ path, entityName: info.entityName });
|
|
308
309
|
}
|
|
309
310
|
}
|
|
310
311
|
const permissionResults = await (0, utils_1.promiseAll)(pathsNeedingCheck.map(async ({ path, entityName }) => {
|
|
311
312
|
const hasAccess = await (0, has_permission_1.hasPermission)({
|
|
312
|
-
roles:
|
|
313
|
+
roles: actorRoles,
|
|
313
314
|
actions: { resource: entityName, operation: "read" },
|
|
314
315
|
container: this.container,
|
|
315
316
|
});
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"rbac-field-filter.js","sourceRoot":"","sources":["../../../../src/http/utils/policies/rbac-field-filter.ts"],"names":[],"mappings":";;;AAAA,
|
|
1
|
+
{"version":3,"file":"rbac-field-filter.js","sourceRoot":"","sources":["../../../../src/http/utils/policies/rbac-field-filter.ts"],"names":[],"mappings":";;;AAAA,qDAIkC;AAClC,uDAAoD;AAEpD,qEAGyC;AAGzC;;GAEG;AACH,MAAM,iBAAiB,GAAG;;;;;CAKzB,CAAA;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,QAAQ;IACR,KAAK;IACL,OAAO;IACP,SAAS;IACT,IAAI;IACJ,UAAU;IACV,MAAM;CACP,CAAC,CAAA;AAEF,2EAA2E;AAC3E,IAAI,YAAY,GAAsC,IAAI,CAAA;AAC1D,IAAI,eAAe,GAAsC,IAAI,CAAA;AAC7D,IAAI,oBAAoB,GAA+B,IAAI,CAAA;AAa3D,SAAS,QAAQ,CAAC,KAAU;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAA;AAClC,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,WAAmB;IAC/C,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,oBAAY,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAA;IAE9E,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAM;IACR,CAAC;IAED,OAAO,oBAAY,CAAC,oBAAoB,CAAC;QACvC,QAAQ,EAAE,aAAa;KACxB,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,mBAAmB;IAC1B,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,YAAY,CAAA;IACrB,CAAC;IAED,YAAY,GAAG,qBAAqB,EAAE,CAAA;IACtC,OAAO,YAAY,CAAA;AACrB,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB;IAC1B,MAAM,mBAAmB,GAAG,0BAAY,CAAC,mBAAmB,EAAE,CAAA;IAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAA;IAE1C,KAAK,MAAM,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,SAAQ;QACV,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC3E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACxE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBAClB,SAAQ;YACV,CAAC;YAED,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAA;YACjC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;YACvC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB;IACxB,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,oBAAoB,GAAG,mBAAmB,EAAE,CAAA;IAC9C,CAAC;IACD,OAAO,oBAAoB,CAAA;AAC7B,CAAC;AAED,SAAS,0BAA0B,CAAC,mBAA0B;IAC5D,MAAM,WAAW,GAAa,EAAE,CAAA;IAEhC,KAAK,MAAM,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACzC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;YACpB,SAAQ;QACV,CAAC;QAED,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACjC,CAAC;IAED,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC/B,CAAC;AAED,SAAS,sBAAsB;IAC7B,MAAM,mBAAmB,GAAG,0BAAY,CAAC,mBAAmB,EAAE,CAAA;IAC9D,MAAM,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAA;IAElD,sBAAsB;IACtB,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAA;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IAEvC,mEAAmE;IACnE,KAAK,MAAM,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACzC,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAA;IACtD,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAC3B,MAAW,EACX,WAAgC,EAChC,SAAqC;IAErC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAM;IACR,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YACjC,SAAQ;QACV,CAAC;QAED,MAAM,kBAAkB,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAA;QAClD,IAAI,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,mBAAmB,CACjB,kBAAkB,EAClB,MAAM,CAAC,MAAM,EACb,WAAW,EACX,SAAS,CACV,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,UAA+B,EAC/B,UAAkB,EAClB,WAAgC,EAChC,SAAqC;IAErC,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAClE,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAA;QAExE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAQ;QACV,CAAC;QAED,8DAA8D;QAC9D,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,aAAa,GAAG,UAAU,CAAA;QAC9B,IAAI,WAAW,GAAG,UAAU,CAAA;QAC5B,IAAI,WAAW,GAAG,IAAI,CAAA;QAEtB,6CAA6C;QAC7C,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,MAAM,aAAa,GAAG,iBAAiB,CACrC,aAAa,EACb,OAAO,EACP,WAAW,CACZ,CAAA;YAED,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,WAAW,GAAG,KAAK,CAAA;gBACnB,MAAK;YACP,CAAC;YAED,aAAa,GAAG,aAAa,CAAC,YAAY,CAAA;YAC1C,WAAW,GAAG,aAAa,CAAC,YAAY,CAAA;QAC1C,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,QAAQ,GAAG,GAAG,UAAU,IAAI,SAAS,EAAE,CAAA;YAE7C,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE;gBACtB,UAAU,EAAE,SAAS;gBACrB,YAAY,EAAE,WAAW;gBACzB,IAAI,EAAE,YAAY;aACnB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CACxB,UAAkB,EAClB,SAAiB,EACjB,WAAgC;IAEhC,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAQ,CAAA;IAE7C,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1C,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YACpC,IAAI,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;YAErB,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;YAClB,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAA;YACrC,IAAI,YAAY,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBACtD,OAAO,EAAE,YAAY,EAAE,CAAA;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;GAEG;AACH,SAAS,YAAY;IACnB,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,eAAe,GAAG,sBAAsB,EAAE,CAAA;IAC5C,CAAC;IACD,OAAO,eAAe,CAAA;AACxB,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB;IAC5B,MAAM,mBAAmB,GAAG,0BAAY,CAAC,mBAAmB,EAAE,CAAA;IAE9D,MAAM,uBAAuB,GAC3B,0BAA0B,CAAC,mBAAmB,CAAC,CAAA;IAEjD,MAAM,eAAe,GAAG,iBAAiB,GAAG,IAAI,GAAG,uBAAuB,CAAA;IAC1E,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,eAAe,CAAC,CAAA;IAE9D,OAAO,gBAAgB,IAAI,IAAI,CAAA;AACjC,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,SAAiB;IAC5C,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAA;IAEpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IACvC,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;IAChC,MAAM,cAAc,GAAG,iBAAiB,EAAE,CAAA;IAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAElC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;IAC5B,MAAM,kBAAkB,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAEzD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,aAAa,GAAG,WAAW,CAAC,kBAAkB,CAAQ,CAAA;IAC1D,IAAI,iBAAiB,GAAG,kBAAkB,CAAA;IAE1C,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAE1B,MAAM,UAAU,GAAG,GAAG,iBAAiB,IAAI,SAAS,EAAE,CAAA;QACtD,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAE/C,IAAI,aAAa,EAAE,CAAC;YAClB,oBAAoB;YACpB,MAAM,gBAAgB,GAAG,aAAa,CAAC,YAAY,CAAA;YACnD,iBAAiB,GAAG,gBAAgB,CAAA;YACpC,aAAa,GAAG,WAAW,CAAC,iBAAiB,CAAQ,CAAA;YAErD,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GAAG,iBAAiB,CACnC,iBAAiB,EACjB,SAAS,EACT,WAAW,CACZ,CAAA;YAED,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAA;YACb,CAAC;YAED,iBAAiB,GAAG,WAAW,CAAC,YAAY,CAAA;YAC5C,aAAa,GAAG,WAAW,CAAC,iBAAiB,CAAQ,CAAA;YAErD,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,iBAAiB,CAAA;AAC1B,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAAC,SAAiB;IAChD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAA;IACvD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,IAAA,mBAAW,EAAC,gBAAgB,CAAC,CAAA;AACtC,CAAC;AAED;;;GAGG;AACH,SAAS,wBAAwB,CAC/B,MAAc,EACd,MAAgB;IAEhB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAoB,CAAA;IAE/C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,aAAa,GAAG,MAAM,GAAG,GAAG,GAAG,KAAK,CAAA;QAC1C,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAE7C,0FAA0F;QAC1F,IAAI,WAAW,GAAG,EAAE,CAAA;QACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,WAAW;gBACT,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;YAEjE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClC,MAAM,UAAU,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAA;gBACvD,WAAW,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAA;YACjE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAA;AACpB,CAAC;AAED;;;GAGG;AACH,MAAa,eAAe;IAI1B,YAAY,EACV,aAAa,EACb,SAAS,GAIV;QACC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;QAClC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;IAC5B,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,OAA2B;QACnD,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAA;QACxC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,YAAY,CAAA;QAC3C,MAAM,aAAa,GAAG,CAAC,GAAG,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;QAE5D,IAAI,CAAC,aAAa,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACrC,OAAO,EAAE,CAAA;QACX,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAA;QAC7C,MAAM,eAAe,GAAG,MAAM,IAAA,qCAAoB,EAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAElE,MAAM,WAAW,GAAG,wBAAwB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;QAEnE,MAAM,iBAAiB,GAA2C,EAAE,CAAA;QACpE,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,UAAU,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5D,iBAAiB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;YAC/D,CAAC;QACH,CAAC;QAED,MAAM,iBAAiB,GAAG,MAAM,IAAA,kBAAU,EACxC,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE;YACnD,MAAM,SAAS,GAAG,MAAM,IAAA,8BAAa,EAAC;gBACpC,KAAK,EAAE,UAAU;gBACjB,OAAO,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE;gBACpD,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAA;YACF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;QAC5B,CAAC,CAAC,CACH,CAAA;QAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAmB,CAAA;QAC5C,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;YACvC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;QAC9C,CAAC;QAED,MAAM,gBAAgB,GAAa,EAAE,CAAA;QACrC,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YAClC,MAAM,aAAa,GAAG,MAAM,GAAG,GAAG,GAAG,KAAK,CAAA;YAC1C,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAE7C,IAAI,WAAW,GAAG,EAAE,CAAA;YACpB,IAAI,YAAY,GAAG,IAAI,CAAA;YAEvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC7C,WAAW;oBACT,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;gBAEjE,yDAAyD;gBACzD,IAAI,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/B,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,WAAW,CAAE,CAAA;oBAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;wBACf,YAAY,GAAG,KAAK,CAAA;wBACpB,MAAK;oBACP,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAC9B,CAAC;QACH,CAAC;QAED,OAAO,gBAAgB,CAAA;IACzB,CAAC;CACF;AAjFD,0CAiFC"}
|
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
import { AuthContext, MedusaContainer, RbacScope } from "@medusajs/types";
|
|
2
|
+
export declare const resolveRoles: ({ authContext, container, scope, }: {
|
|
3
|
+
authContext: Pick<AuthContext, "actor_type" | "actor_id">;
|
|
4
|
+
container: MedusaContainer;
|
|
5
|
+
/**
|
|
6
|
+
* The scope the request acts within, resolved by the application. Role
|
|
7
|
+
* assignments scoped to it, as well as unscoped assignments, are considered.
|
|
8
|
+
*
|
|
9
|
+
* When it is not provided, only unscoped assignments are considered.
|
|
10
|
+
*/
|
|
11
|
+
scope?: RbacScope;
|
|
12
|
+
}) => Promise<string[]>;
|
|
13
|
+
//# sourceMappingURL=resolve-roles.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"resolve-roles.d.ts","sourceRoot":"","sources":["../../../src/http/utils/resolve-roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAIzE,eAAO,MAAM,YAAY,GAAU,oCAIhC;IACD,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,GAAG,UAAU,CAAC,CAAA;IACzD,SAAS,EAAE,eAAe,CAAA;IAC1B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB,sBA2CA,CAAA"}
|
|
@@ -0,0 +1,42 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.resolveRoles = void 0;
|
|
4
|
+
const utils_1 = require("@medusajs/utils");
|
|
5
|
+
const build_authz_context_1 = require("./build-authz-context");
|
|
6
|
+
const resolveRoles = async ({ authContext, container, scope, }) => {
|
|
7
|
+
const rbacModule = container.resolve(utils_1.Modules.RBAC);
|
|
8
|
+
const { actor_type, actor_id } = authContext;
|
|
9
|
+
const authzConfig = await rbacModule.retrieveActorAutzContextConfig(actor_type);
|
|
10
|
+
if (!authzConfig) {
|
|
11
|
+
return [];
|
|
12
|
+
}
|
|
13
|
+
const authzContext = await (0, build_authz_context_1.buildAuthzContext)({
|
|
14
|
+
actor_type,
|
|
15
|
+
actor_id,
|
|
16
|
+
config: authzConfig,
|
|
17
|
+
container,
|
|
18
|
+
});
|
|
19
|
+
if (!authzContext.grantees.length) {
|
|
20
|
+
return [];
|
|
21
|
+
}
|
|
22
|
+
const assignments = await rbacModule.listRbacRoleAssignments({
|
|
23
|
+
$and: [
|
|
24
|
+
{
|
|
25
|
+
$or: authzContext.grantees.map((g) => ({
|
|
26
|
+
reference: g.type,
|
|
27
|
+
reference_id: g.id,
|
|
28
|
+
})),
|
|
29
|
+
},
|
|
30
|
+
{
|
|
31
|
+
$or: [
|
|
32
|
+
// Unscoped role assignments allow exercising privileges across all scopes.
|
|
33
|
+
{ scope: null, scope_id: null },
|
|
34
|
+
...(scope ? [{ scope: scope.type, scope_id: scope.id }] : []),
|
|
35
|
+
],
|
|
36
|
+
},
|
|
37
|
+
],
|
|
38
|
+
});
|
|
39
|
+
return (0, utils_1.deduplicate)(assignments.map((assignment) => assignment.role_id));
|
|
40
|
+
};
|
|
41
|
+
exports.resolveRoles = resolveRoles;
|
|
42
|
+
//# sourceMappingURL=resolve-roles.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"resolve-roles.js","sourceRoot":"","sources":["../../../src/http/utils/resolve-roles.ts"],"names":[],"mappings":";;;AACA,2CAAsD;AACtD,+DAAyD;AAElD,MAAM,YAAY,GAAG,KAAK,EAAE,EACjC,WAAW,EACX,SAAS,EACT,KAAK,GAWN,EAAE,EAAE;IACH,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,eAAO,CAAC,IAAI,CAAC,CAAA;IAElD,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAA;IAE5C,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,8BAA8B,CACjE,UAAU,CACX,CAAA;IAED,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,IAAA,uCAAiB,EAAC;QAC3C,UAAU;QACV,QAAQ;QACR,MAAM,EAAE,WAAW;QACnB,SAAS;KACV,CAAC,CAAA;IAEF,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAClC,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,uBAAuB,CAAC;QAC3D,IAAI,EAAE;YACJ;gBACE,GAAG,EAAE,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACrC,SAAS,EAAE,CAAC,CAAC,IAAI;oBACjB,YAAY,EAAE,CAAC,CAAC,EAAE;iBACnB,CAAC,CAAC;aACJ;YACD;gBACE,GAAG,EAAE;oBACH,2EAA2E;oBAC3E,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;oBAC/B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9D;aACF;SACF;KACF,CAAC,CAAA;IAEF,OAAO,IAAA,mBAAW,EAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAA;AACzE,CAAC,CAAA;AAzDY,QAAA,YAAY,gBAyDxB"}
|
|
@@ -21,6 +21,10 @@ export type ResolvePermissionsInput = {
|
|
|
21
21
|
}[];
|
|
22
22
|
container: MedusaContainer;
|
|
23
23
|
};
|
|
24
|
+
export type ListRolePermissionsInput = {
|
|
25
|
+
roles: string | string[];
|
|
26
|
+
container: MedusaContainer;
|
|
27
|
+
};
|
|
24
28
|
/**
|
|
25
29
|
* Checks if the given role(s) have permission to perform the specified action(s).
|
|
26
30
|
*
|
|
@@ -65,4 +69,26 @@ export declare function hasPermission(input: HasPermissionInput): Promise<boolea
|
|
|
65
69
|
* ```
|
|
66
70
|
*/
|
|
67
71
|
export declare function resolvePermissions(input: ResolvePermissionsInput): Promise<Set<string>>;
|
|
72
|
+
/**
|
|
73
|
+
* Lists the permissions the given roles grant, as `resource:operation` strings.
|
|
74
|
+
*
|
|
75
|
+
* Wildcards are listed as they are stored (e.g. `product:*`, `*:*`), because
|
|
76
|
+
* expanding them requires the universe of persisted policies. Use
|
|
77
|
+
* {@link resolvePermissions} when the expanded set is needed.
|
|
78
|
+
*
|
|
79
|
+
* @example
|
|
80
|
+
* ```ts
|
|
81
|
+
* const permissions = await listRolePermissions({
|
|
82
|
+
* roles: ["role_123"],
|
|
83
|
+
* container,
|
|
84
|
+
* })
|
|
85
|
+
* // permissions = ["product:delete", "product:read"]
|
|
86
|
+
* ```
|
|
87
|
+
*/
|
|
88
|
+
export declare function listRolePermissions(input: ListRolePermissionsInput): Promise<string[]>;
|
|
89
|
+
/**
|
|
90
|
+
* Fetches the set of governed resources: every distinct `rbac_policy.resource`
|
|
91
|
+
* from cache or database.
|
|
92
|
+
*/
|
|
93
|
+
export declare function fetchPolicyResources(container: MedusaContainer): Promise<Set<string>>;
|
|
68
94
|
//# sourceMappingURL=has-permission.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"has-permission.d.ts","sourceRoot":"","sources":["../../src/policies/has-permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;
|
|
1
|
+
{"version":3,"file":"has-permission.d.ts","sourceRoot":"","sources":["../../src/policies/has-permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AASjD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAC7B,CAAA;AASD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACxB,OAAO,EAAE,gBAAgB,GAAG,gBAAgB,EAAE,CAAA;IAC9C,SAAS,EAAE,eAAe,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACxB;;;;OAIG;IACH,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACnD,SAAS,EAAE,eAAe,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACxB,SAAS,EAAE,eAAe,CAAA;CAC3B,CAAA;AA2BD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,OAAO,CAAC,CAyBlB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAwBtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,MAAM,EAAE,CAAC,CAqBnB;AAoDD;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,eAAe,GACzB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CA2BtB"}
|