@objectstack/core 16.0.0-rc.1 → 16.1.0

package/dist/index.cjs

@@ -98,6 +98,7 @@ __export(index_exports, {
   resolveAuthzContext: () => resolveAuthzContext,
   resolveLocale: () => resolveLocale,
   resolveLocalizationContext: () => resolveLocalizationContext,
+  resolveUserAuthzGrants: () => resolveUserAuthzGrants,
   safeExit: () => safeExit,
   shouldDenyAnonymous: () => shouldDenyAnonymous,
   signPayload: () => signPayload,
@@ -4436,6 +4437,31 @@ async function resolveAuthzContext(input) {
   ctx.userId = userId;
   if (tenantId) ctx.tenantId = tenantId;
   if (!ql || typeof ql.find !== "function") return ctx;
+  const grants = await resolveUserAuthzGrants(ql, userId, {
+    tenantId,
+    nowMs: input.nowMs,
+    seedPermissions: ctx.permissions,
+    seedEmail: ctx.email
+  });
+  ctx.positions = grants.positions;
+  ctx.permissions = grants.permissions;
+  ctx.systemPermissions = grants.systemPermissions;
+  ctx.org_user_ids = grants.org_user_ids;
+  if (grants.tabPermissions) ctx.tabPermissions = grants.tabPermissions;
+  if (grants.posture) ctx.posture = grants.posture;
+  if (grants.email && !ctx.email) ctx.email = grants.email;
+  return ctx;
+}
+async function resolveUserAuthzGrants(ql, userId, opts = {}) {
+  const { tenantId } = opts;
+  const grants = {
+    positions: [],
+    permissions: Array.isArray(opts.seedPermissions) ? [...opts.seedPermissions] : [],
+    systemPermissions: [],
+    org_user_ids: [userId]
+  };
+  if (opts.seedEmail) grants.email = opts.seedEmail;
+  if (!ql || typeof ql.find !== "function") return grants;
   let userRowLoaded = false;
   let userRow;
   const getUserRow = async () => {
@@ -4446,9 +4472,9 @@ async function resolveAuthzContext(input) {
     }
     return userRow;
   };
-  if (!ctx.email) {
+  if (!grants.email) {
     const u = await getUserRow();
-    if (u?.email) ctx.email = String(u.email);
+    if (u?.email) grants.email = String(u.email);
   }
   const memberWhere = tenantId ? { user_id: userId, organization_id: tenantId } : { user_id: userId };
   const members = await tryFind(ql, "sys_member", memberWhere, 50);
@@ -4456,18 +4482,18 @@ async function resolveAuthzContext(input) {
     if (m.role && typeof m.role === "string") {
       for (const raw of m.role.split(",").map((s) => s.trim()).filter(Boolean)) {
         const r = (0, import_spec.mapMembershipRole)(raw);
-        if (!ctx.positions.includes(r)) ctx.positions.push(r);
+        if (!grants.positions.includes(r)) grants.positions.push(r);
       }
     }
   }
-  const nowMs = input.nowMs ?? Date.now();
+  const nowMs = opts.nowMs ?? Date.now();
   const userPositionRows = await tryFind(ql, "sys_user_position", { user_id: userId }, 200);
   for (const ur of userPositionRows) {
     const org = ur.organization_id ?? null;
     if (org && tenantId && org !== tenantId) continue;
     if (!isGrantActive(ur, nowMs)) continue;
     const r = ur.position;
-    if (typeof r === "string" && r && !ctx.positions.includes(r)) ctx.positions.push(r);
+    if (typeof r === "string" && r && !grants.positions.includes(r)) grants.positions.push(r);
   }
   if (tenantId) {
     const orgMembers = await tryFind(ql, "sys_member", { organization_id: tenantId }, 1e3);
@@ -4475,9 +4501,7 @@ async function resolveAuthzContext(input) {
       orgMembers.map((m) => m.user_id ?? m.userId).filter((v) => typeof v === "string" && v.length > 0)
     );
     ids.add(userId);
-    ctx.org_user_ids = Array.from(ids);
-  } else {
-    ctx.org_user_ids = [userId];
+    grants.org_user_ids = Array.from(ids);
   }
   const upsRowsAll = await tryFind(ql, "sys_user_permission_set", { user_id: userId }, 100);
   const upsRows = upsRowsAll.filter((r) => isGrantActive(r, nowMs));
@@ -4491,9 +4515,9 @@ async function resolveAuthzContext(input) {
     upsRows.filter((r) => (r.organization_id ?? r.organizationId ?? null) === null).map((r) => r.permission_set_id ?? r.permissionSetId).filter(Boolean)
   );
   let hasPlatformAdminGrant = false;
-  if (!ctx.positions.includes("everyone")) ctx.positions.push("everyone");
-  if (ctx.positions.length > 0) {
-    const positionRows = await tryFind(ql, "sys_position", { name: { $in: ctx.positions } }, 100);
+  if (!grants.positions.includes("everyone")) grants.positions.push("everyone");
+  if (grants.positions.length > 0) {
+    const positionRows = await tryFind(ql, "sys_position", { name: { $in: grants.positions } }, 100);
     const positionIds = positionRows.map((r) => r.id).filter(Boolean);
     if (positionIds.length > 0) {
       const rpsRows = await tryFind(ql, "sys_position_permission_set", { position_id: { $in: positionIds } }, 500);
@@ -4508,12 +4532,12 @@ async function resolveAuthzContext(input) {
     const tabRank = { hidden: 0, default_off: 1, default_on: 2, visible: 3 };
     const mergedTabs = {};
     for (const ps of psRows) {
-      if (ps.name && !ctx.permissions.includes(ps.name)) ctx.permissions.push(ps.name);
+      if (ps.name && !grants.permissions.includes(ps.name)) grants.permissions.push(ps.name);
       if (ps.name === import_spec.ADMIN_FULL_ACCESS && unscopedUserPsIds.has(ps.id)) hasPlatformAdminGrant = true;
       const sysPerms = typeof ps.system_permissions === "string" ? safeJsonParse2(ps.system_permissions, []) : ps.system_permissions ?? ps.systemPermissions;
       if (Array.isArray(sysPerms)) {
         for (const p of sysPerms) {
-          if (typeof p === "string" && !ctx.systemPermissions.includes(p)) ctx.systemPermissions.push(p);
+          if (typeof p === "string" && !grants.systemPermissions.includes(p)) grants.systemPermissions.push(p);
         }
       }
       const tabs = typeof ps.tab_permissions === "string" ? safeJsonParse2(ps.tab_permissions, {}) : ps.tab_permissions ?? ps.tabPermissions;
@@ -4527,20 +4551,20 @@ async function resolveAuthzContext(input) {
         }
       }
     }
-    if (Object.keys(mergedTabs).length > 0) ctx.tabPermissions = mergedTabs;
+    if (Object.keys(mergedTabs).length > 0) grants.tabPermissions = mergedTabs;
   }
-  if (hasPlatformAdminGrant && !ctx.positions.includes(import_spec.BUILTIN_IDENTITY_PLATFORM_ADMIN)) {
-    ctx.positions.unshift(import_spec.BUILTIN_IDENTITY_PLATFORM_ADMIN);
+  if (hasPlatformAdminGrant && !grants.positions.includes(import_spec.BUILTIN_IDENTITY_PLATFORM_ADMIN)) {
+    grants.positions.unshift(import_spec.BUILTIN_IDENTITY_PLATFORM_ADMIN);
   }
-  ctx.posture = derivePosture({
+  grants.posture = derivePosture({
     isPlatformAdmin: hasPlatformAdminGrant,
-    isTenantAdmin: ctx.permissions.includes(import_spec.ORGANIZATION_ADMIN)
+    isTenantAdmin: grants.permissions.includes(import_spec.ORGANIZATION_ADMIN)
   });
-  if (!ctx.permissions.includes("ai_seat")) {
+  if (!grants.permissions.includes("ai_seat")) {
     const aiAccess = (await getUserRow())?.ai_access;
-    if (aiAccess === true || aiAccess === 1 || aiAccess === "1") ctx.permissions.push("ai_seat");
+    if (aiAccess === true || aiAccess === 1 || aiAccess === "1") grants.permissions.push("ai_seat");
   }
-  return ctx;
+  return grants;
 }
 function isValidTimeZone(tz) {
   try {
@@ -5865,6 +5889,7 @@ var NamespaceResolver = class {
   resolveAuthzContext,
   resolveLocale,
   resolveLocalizationContext,
+  resolveUserAuthzGrants,
   safeExit,
   shouldDenyAnonymous,
   signPayload,