@mondaydotcomorg/monday-authorization 1.0.10 → 1.0.12

package/README.md

@@ -38,16 +38,16 @@ router.use(authorizationCheckMiddleware);
 router.post('/posts/:postId/like', getAuthorizationMiddleware(action, resourceGetter),
   like
 );
-router.get('/internal/some_unauthorized_endpoint', skipAuthorizationMiddleware);
+router.get('/internal/some_unauthorized_endpoint', skipAuthorizationMiddleware, handler);
 
 ```
 
-resourceGetter is a function that gets the request and return an array of resources.
-wrapper_data is additional data to create a wrapper model in the monolith. It is optional.
+`resourceGetter` is a function that gets the request and return an array of resources.
+`wrapper_data` is additional data to create a wrapper model in the monolith. It is optional.
 In this example the monolith can instantiate a wrapper of post instead of the post itself.
 The item_id is all that needed for the authorization of posts.
 
-accountId and userId are needed for the authorization and are taken from the authentication middelware
+`accountId` and `userId` are needed for the authorization and are taken from the authentication middelware
 by default. If you're not using the authentication middleware, you will have to provide a contextGetter
 function, that looks like this:
 
@@ -60,7 +60,6 @@ function, that looks like this:
 }
 ```
 
-Add authorizationCheckMiddleware to make sure that all routes are covered by authorization check. Put this
+Add `authorizationCheckMiddleware` to make sure that all routes are covered by authorization check. Put this
 middleware before you define the routes.
-If you want to skip authorization, use skipAuthorizationMiddleware.
-
+If you want to skip authorization, use `skipAuthorizationMiddleware`.

package/dist/lib/authorization-middleware.js

@@ -22,7 +22,7 @@ function getAuthorizationMiddleware(action, resourceGetter, contextGetter) {
             contextGetter || (contextGetter = defaultContextGetter);
             const { userId, accountId } = contextGetter(request);
             const resources = resourceGetter(request);
-            const isAuthorized = yield authorization_service_1.AuthorizationService.isAuthorized(accountId, userId, resources, action);
+            const { isAuthorized } = yield authorization_service_1.AuthorizationService.isAuthorized(accountId, userId, resources, action);
             authorization_internal_service_1.AuthorizationInternalService.markAuthorized(request);
             if (!isAuthorized) {
                 response.status(403).json({ message: 'Access denied' });

package/dist/lib/authorization-service.d.ts

@@ -1,4 +1,8 @@
 import { Action, Resource } from './types/general';
+export interface AuthorizeResponse {
+    isAuthorized: boolean;
+    unauthorizedIds?: number[];
+}
 export declare class AuthorizationService {
-    static isAuthorized(accountId: number, userId: number, resources: Resource[], action: Action): Promise<boolean>;
+    static isAuthorized(accountId: number, userId: number, resources: Resource[], action: Action): Promise<AuthorizeResponse>;
 }

package/dist/lib/authorization-service.js

@@ -56,7 +56,7 @@ class AuthorizationService {
             }, { retries: 3, callback: logOnFetchFail });
             if (!response.ok) {
                 logger.error({ status: response.status }, 'Authorization middleware: authorization request failed');
-                return false;
+                return { isAuthorized: false };
             }
             const responseBody = yield response.json();
             const unauthorizedObjects = [];
@@ -69,9 +69,10 @@ class AuthorizationService {
                 logger.info({
                     resources: JSON.stringify(unauthorizedObjects),
                 }, 'Authorization middleware: resource is unauthorized');
-                return false;
+                const unauthorizedIds = unauthorizedObjects.map(obj => obj.resource_id);
+                return { isAuthorized: false, unauthorizedIds };
             }
-            return true;
+            return { isAuthorized: true };
         });
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mondaydotcomorg/monday-authorization",
-  "version": "1.0.10",
+  "version": "1.0.12",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "license": "BSD-3-Clause",
@@ -31,5 +31,5 @@
   "files": [
     "dist/"
   ],
-  "gitHead": "27da993cbc76e1787a3a006ee5f78df9a1192ff9"
+  "gitHead": "16d2310591611bdd3eb76f3badad0835842513cd"
 }