@mondart/nestjs-common-module-iam 3.2.14 → 3.2.15
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +7 -3
- package/dist/interfaces/iam-context-options.interface.d.ts +2 -0
- package/dist/interfaces/iam-context-options.interface.d.ts.map +1 -1
- package/dist/interfaces/iam-context-options.interface.js.map +1 -1
- package/dist/services/iam-permission.service.d.ts.map +1 -1
- package/dist/services/iam-permission.service.js +8 -9
- package/dist/services/iam-permission.service.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -72,9 +72,10 @@ findAll() { ... }
|
|
|
72
72
|
```
|
|
73
73
|
|
|
74
74
|
An agent needs every listed key in its `permissions` claim (client roles of
|
|
75
|
-
the back-office `permissions` client,
|
|
76
|
-
|
|
77
|
-
|
|
75
|
+
the back-office `permissions` client, bundled into IAM roles that groups
|
|
76
|
+
grant), or its service's wildcard: `order:*` covers every `order:` key. An
|
|
77
|
+
agent in a group whose path ends with `/super-admin` passes every check.
|
|
78
|
+
Users and guests are rejected on these routes.
|
|
78
79
|
|
|
79
80
|
```ts
|
|
80
81
|
IamContextModule.forRoot({
|
|
@@ -85,6 +86,9 @@ IamContextModule.forRoot({
|
|
|
85
86
|
- `service`: key prefix of this service. On boot every declared key is sent to
|
|
86
87
|
IAM as `iam.permission.sync`, so IAM can create the roles.
|
|
87
88
|
- `kafkaClient`: injection token of the `ClientKafka` that sends the sync event.
|
|
89
|
+
- `extraKeys`: keys checked in code with `IamPermissionService.hasPermissions`
|
|
90
|
+
(e.g. on a route users share) instead of `@RequirePermission()`. They are
|
|
91
|
+
synced with the decorated ones, so IAM doesn't mark them deprecated.
|
|
88
92
|
|
|
89
93
|
## Verifying tokens in the service
|
|
90
94
|
|
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
import { Type } from '@nestjs/common';
|
|
2
2
|
import { EntityTarget } from 'typeorm';
|
|
3
3
|
import { IamUserTypeEnum } from '../enums/iam-user-type.enum';
|
|
4
|
+
import type { IamPermissionDefinition } from '../decorators/require-permission.decorator';
|
|
4
5
|
import { ApplyIamEntityScopeOptions, EntityAccessByRole } from './iam-entity-access.interface';
|
|
5
6
|
export type IamControllerClass = Type<unknown>;
|
|
6
7
|
export type IamControllerMatcher = string | IamControllerClass;
|
|
@@ -20,6 +21,7 @@ export interface IamContextModuleOptions {
|
|
|
20
21
|
permissions?: {
|
|
21
22
|
service?: string;
|
|
22
23
|
kafkaClient?: string | symbol;
|
|
24
|
+
extraKeys?: IamPermissionDefinition[];
|
|
23
25
|
};
|
|
24
26
|
tokenVerification?: {
|
|
25
27
|
issuers: string[];
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-context-options.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/iam-context-options.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EACnB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/C,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,kBAAkB,CAAC;AAE/D,MAAM,WAAW,qBAAqB,CAAC,CAAC,GAAG,GAAG;IAC5C,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAKxB,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAK/B,KAAK,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IAE/C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IAItC,uBAAuB,CAAC,EAAE,eAAe,EAAE,CAAC;IAM5C,8BAA8B,CAAC,EAAE,OAAO,CAAC;IAWzC,WAAW,CAAC,EAAE;QACZ,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;QAChC,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;KACjC,CAAC;
|
|
1
|
+
{"version":3,"file":"iam-context-options.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/iam-context-options.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AAC1F,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EACnB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/C,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,kBAAkB,CAAC;AAE/D,MAAM,WAAW,qBAAqB,CAAC,CAAC,GAAG,GAAG;IAC5C,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAKxB,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAK/B,KAAK,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IAE/C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IAItC,uBAAuB,CAAC,EAAE,eAAe,EAAE,CAAC;IAM5C,8BAA8B,CAAC,EAAE,OAAO,CAAC;IAWzC,WAAW,CAAC,EAAE;QACZ,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;QAChC,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;KACjC,CAAC;IAgBF,WAAW,CAAC,EAAE;QACZ,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAC9B,SAAS,CAAC,EAAE,uBAAuB,EAAE,CAAC;KACvC,CAAC;IAcF,iBAAiB,CAAC,EAAE;QAClB,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF,YAAY,CAAC,EAAE;QAIb,aAAa,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAKxC,YAAY,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC;QAKxD,OAAO,CAAC,EAAE,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;KACxC,CAAC;CACH;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;IACf,UAAU,EAAE,CACV,GAAG,IAAI,EAAE,GAAG,EAAE,KACX,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACjE;AAED,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E,eAAO,MAAM,kCAAkC,EAAE,QAAQ,CACvD,IAAI,CACF,uBAAuB,EACvB,yBAAyB,GAAG,gCAAgC,CAC7D,CACF,GACC,IAAI,CACF,uBAAuB,EACvB,yBAAyB,GAAG,gCAAgC,CAa/D,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-context-options.interface.js","sourceRoot":"","sources":["../../src/interfaces/iam-context-options.interface.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"iam-context-options.interface.js","sourceRoot":"","sources":["../../src/interfaces/iam-context-options.interface.ts"],"names":[],"mappings":";;;AAqHa,QAAA,0BAA0B,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAElE,QAAA,kCAAkC,GASzC;IACJ,uBAAuB,EAAE,EAAE;IAC3B,8BAA8B,EAAE,KAAK;IACrC,WAAW,EAAE;QACX,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,EAAE;KACX;IACD,YAAY,EAAE;QACZ,aAAa,EAAE,SAAS;QACxB,YAAY,EAAE,SAAS;QACvB,OAAO,EAAE,EAAE;KACZ;CACF,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-permission.service.d.ts","sourceRoot":"","sources":["../../src/services/iam-permission.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,sBAAsB,EACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAOtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAEL,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AAarD,qBACa,oBAAqB,YAAW,sBAAsB;IAK/D,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAP5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;gBAI7C,aAAa,EAAE,uBAAuB,EACtC,gBAAgB,EAAE,gBAAgB,EAClC,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,SAAS;
|
|
1
|
+
{"version":3,"file":"iam-permission.service.d.ts","sourceRoot":"","sources":["../../src/services/iam-permission.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,sBAAsB,EACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAOtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAEL,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AAarD,qBACa,oBAAqB,YAAW,sBAAsB;IAK/D,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAP5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;gBAI7C,aAAa,EAAE,uBAAuB,EACtC,gBAAgB,EAAE,gBAAgB,EAClC,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,SAAS;IAQvC,cAAc,CACZ,KAAK,EAAE,iBAAiB,GAAG,SAAS,EACpC,QAAQ,EAAE,MAAM,EAAE,GACjB,OAAO;IAoBJ,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAwB7C,kBAAkB,IAAI,uBAAuB,EAAE;IAyB/C,OAAO,CAAC,cAAc;CAOvB"}
|
|
@@ -36,7 +36,7 @@ let IamPermissionService = IamPermissionService_1 = class IamPermissionService {
|
|
|
36
36
|
return true;
|
|
37
37
|
}
|
|
38
38
|
const granted = new Set(permissions ?? []);
|
|
39
|
-
return required.every((key) => granted.has(key));
|
|
39
|
+
return required.every((key) => granted.has(key) || granted.has(`${key.split(':')[0]}:*`));
|
|
40
40
|
}
|
|
41
41
|
async onApplicationBootstrap() {
|
|
42
42
|
const service = this.moduleOptions.permissions?.service;
|
|
@@ -58,14 +58,12 @@ let IamPermissionService = IamPermissionService_1 = class IamPermissionService {
|
|
|
58
58
|
}
|
|
59
59
|
collectPermissions() {
|
|
60
60
|
const byKey = new Map();
|
|
61
|
-
const
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
});
|
|
68
|
-
};
|
|
61
|
+
const addAll = (definitions) => definitions.forEach((definition) => {
|
|
62
|
+
if (!byKey.get(definition.key)?.description) {
|
|
63
|
+
byKey.set(definition.key, definition);
|
|
64
|
+
}
|
|
65
|
+
});
|
|
66
|
+
const add = (target) => addAll(Reflect.getMetadata(iam_decorator_key_const_1.IAM_ROUTE_PERMISSIONS, target) ?? []);
|
|
69
67
|
for (const wrapper of this.discoveryService.getControllers()) {
|
|
70
68
|
const { instance, metatype } = wrapper;
|
|
71
69
|
if (!instance || !metatype)
|
|
@@ -76,6 +74,7 @@ let IamPermissionService = IamPermissionService_1 = class IamPermissionService {
|
|
|
76
74
|
.getAllMethodNames(prototype)
|
|
77
75
|
.forEach((name) => add(prototype[name]));
|
|
78
76
|
}
|
|
77
|
+
addAll(this.moduleOptions.permissions?.extraKeys ?? []);
|
|
79
78
|
return [...byKey.values()];
|
|
80
79
|
}
|
|
81
80
|
getKafkaClient() {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-permission.service.js","sourceRoot":"","sources":["../../src/services/iam-permission.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAKwB;AACxB,uCAA4E;AAE5E,+BAA2D;AAC3D,kFAI8C;AAE9C,+FAGqD;AAOrD,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAOxB,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAG/B,YAEE,aAAuD,EACtC,gBAAkC,EAClC,eAAgC,EAChC,SAAoB;QAHpB,kBAAa,GAAb,aAAa,CAAyB;QACtC,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,oBAAe,GAAf,eAAe,CAAiB;QAChC,cAAS,GAAT,SAAS,CAAW;QAPtB,WAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAQ7D,CAAC;
|
|
1
|
+
{"version":3,"file":"iam-permission.service.js","sourceRoot":"","sources":["../../src/services/iam-permission.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAKwB;AACxB,uCAA4E;AAE5E,+BAA2D;AAC3D,kFAI8C;AAE9C,+FAGqD;AAOrD,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAOxB,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAG/B,YAEE,aAAuD,EACtC,gBAAkC,EAClC,eAAgC,EAChC,SAAoB;QAHpB,kBAAa,GAAb,aAAa,CAAyB;QACtC,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,oBAAe,GAAf,eAAe,CAAiB;QAChC,cAAS,GAAT,SAAS,CAAW;QAPtB,WAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAQ7D,CAAC;IAOJ,cAAc,CACZ,KAAoC,EACpC,QAAkB;QAElB,IAAI,CAAC,KAAK,EAAE,OAAO;YAAE,OAAO,KAAK,CAAC;QAElC,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC;QAGhD,IACE,gBAAgB,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC9B,IAAI,CAAC,QAAQ,CAAC,sDAA4B,CAAC,CAC5C,EACD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC,KAAK,CACnB,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CACnE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,IAAA,qBAAc,EAClB,IAAI,CAAC,cAAc,EAAE;iBAClB,IAAI,CAAC,mDAAyB,EAAE;gBAC/B,YAAY,EAAE,OAAO;gBACrB,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;aAC/B,CAAC;iBACD,IAAI,CAAC,IAAA,cAAO,EAAC,gBAAgB,CAAC,CAAC,CACnC,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,WAAW,CAAC,MAAM,qBAAqB,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAMD,kBAAkB;QAChB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmC,CAAC;QACzD,MAAM,MAAM,GAAG,CAAC,WAAsC,EAAE,EAAE,CACxD,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE;YACjC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC;gBAC5C,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,CAAC;QACH,CAAC,CAAC,CAAC;QACL,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,EAAE,CAC7B,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,+CAAqB,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAEnE,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,EAAE,CAAC;YAC7D,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;YACvC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACrC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACd,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,CAAC,eAAe;iBACjB,iBAAiB,CAAC,SAAS,CAAC;iBAC5B,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;QAExD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7B,CAAC;IAEO,cAAc;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC;QAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;CACF,CAAA;AA/FY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,0DAA0B,CAAC,CAAA;6CAEA,uBAAgB;QACjB,sBAAe;QACrB,gBAAS;GAR5B,oBAAoB,CA+FhC"}
|