@objectstack/core 14.3.0 → 14.5.0

package/dist/index.cjs

@@ -78,6 +78,8 @@ __export(index_exports, {
   hashApiKey: () => hashApiKey,
   isAuthGateAllowlisted: () => isAuthGateAllowlisted,
   isExpired: () => isExpired,
+  isGrantActive: () => isGrantActive,
+  isGrantExpired: () => isGrantExpired,
   isNode: () => isNode,
   parseScopes: () => parseScopes,
   parseSignature: () => parseSignature,
@@ -4215,6 +4217,33 @@ function safeJsonParse(s, fallback) {
 
 // src/security/resolve-authz-context.ts
 var import_spec = require("@objectstack/spec");
+
+// src/security/grant-validity.ts
+function toEpochMs(value) {
+  if (value == null || value === "") return void 0;
+  if (typeof value === "number") {
+    return value < 1e12 ? value * 1e3 : value;
+  }
+  if (value instanceof Date) return value.getTime();
+  if (typeof value === "string") return Date.parse(value);
+  return Number.NaN;
+}
+function isGrantActive(row, nowMs) {
+  if (!row) return false;
+  const from = toEpochMs(row.valid_from ?? row.validFrom);
+  if (from !== void 0 && !(nowMs >= from)) return false;
+  const until = toEpochMs(row.valid_until ?? row.validUntil);
+  if (until !== void 0 && !(nowMs < until)) return false;
+  return true;
+}
+function isGrantExpired(row, nowMs) {
+  if (!row) return false;
+  const until = toEpochMs(row.valid_until ?? row.validUntil);
+  if (until === void 0) return false;
+  return !(nowMs < until);
+}
+
+// src/security/resolve-authz-context.ts
 function safeJsonParse2(s, fallback) {
   try {
     return JSON.parse(s);
@@ -4288,10 +4317,12 @@ async function resolveAuthzContext(input) {
       }
     }
   }
+  const nowMs = input.nowMs ?? Date.now();
   const userPositionRows = await tryFind(ql, "sys_user_position", { user_id: userId }, 200);
   for (const ur of userPositionRows) {
     const org = ur.organization_id ?? null;
     if (org && tenantId && org !== tenantId) continue;
+    if (!isGrantActive(ur, nowMs)) continue;
     const r = ur.position;
     if (typeof r === "string" && r && !ctx.positions.includes(r)) ctx.positions.push(r);
   }
@@ -4305,7 +4336,8 @@ async function resolveAuthzContext(input) {
   } else {
     ctx.org_user_ids = [userId];
   }
-  const upsRows = await tryFind(ql, "sys_user_permission_set", { user_id: userId }, 100);
+  const upsRowsAll = await tryFind(ql, "sys_user_permission_set", { user_id: userId }, 100);
+  const upsRows = upsRowsAll.filter((r) => isGrantActive(r, nowMs));
   const psIds = new Set(
     upsRows.filter((r) => {
       const org = r.organization_id ?? r.organizationId ?? null;
@@ -5511,6 +5543,8 @@ var NamespaceResolver = class {
   hashApiKey,
   isAuthGateAllowlisted,
   isExpired,
+  isGrantActive,
+  isGrantExpired,
   isNode,
   parseScopes,
   parseSignature,