@oktis-works/auth 0.5.5 → 0.5.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/rbac/index.d.ts +8 -0
- package/dist/rbac/index.d.ts.map +1 -1
- package/dist/rbac/index.js +41 -0
- package/dist/rbac/index.js.map +1 -1
- package/package.json +4 -4
package/dist/rbac/index.d.ts
CHANGED
|
@@ -6,6 +6,12 @@ export interface Permission {
|
|
|
6
6
|
export interface RolePermissions {
|
|
7
7
|
role: string;
|
|
8
8
|
permissions: Permission[];
|
|
9
|
+
/**
|
|
10
|
+
* Negações explícitas (valem mesmo contra um wildcard na permissão).
|
|
11
|
+
* Ex.: o gestor do tenant vê plugins (`read`) mas só o SUPER_ADMIN
|
|
12
|
+
* instala/ativa/remove (`create`/`update`/`delete`).
|
|
13
|
+
*/
|
|
14
|
+
denies?: Permission[];
|
|
9
15
|
}
|
|
10
16
|
export interface RBACPolicy {
|
|
11
17
|
roles: RolePermissions[];
|
|
@@ -15,6 +21,8 @@ export declare class RBACService {
|
|
|
15
21
|
private policy;
|
|
16
22
|
constructor(policy?: RBACPolicy);
|
|
17
23
|
hasPermission(userRoles: string[], action: string, resource: string, context?: Record<string, unknown>): boolean;
|
|
24
|
+
private isDenied;
|
|
25
|
+
private walkRoles;
|
|
18
26
|
getUserPermissions(userRoles: string[]): Permission[];
|
|
19
27
|
private resolvePermissions;
|
|
20
28
|
private checkConditions;
|
package/dist/rbac/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rbac/index.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,UAAU,EAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rbac/index.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B;;;;OAIG;IACH,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACvC;AA2DD,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAAa;gBAEf,MAAM,CAAC,EAAE,UAAU;IAI/B,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO;IA2BhH,OAAO,CAAC,QAAQ;IAQhB,OAAO,CAAC,SAAS;IA0BjB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,UAAU,EAAE;IAIrD,OAAO,CAAC,kBAAkB;IA2B1B,OAAO,CAAC,eAAe;CAYxB"}
|
package/dist/rbac/index.js
CHANGED
|
@@ -12,6 +12,14 @@ const DEFAULT_POLICY = {
|
|
|
12
12
|
// `roles` vs política `role`, taxonomy, content-type...) e davam 403
|
|
13
13
|
// para o próprio dono do tenant.
|
|
14
14
|
permissions: [{ action: '*', resource: '*' }],
|
|
15
|
+
// ...menos gestão de plugins: instalação/ativação/remoção é operação de
|
|
16
|
+
// plataforma (SUPER_ADMIN). Listar (`read`) continua liberado, afinal o
|
|
17
|
+
// gestor do tenant precisa ver o que está ativo nele.
|
|
18
|
+
denies: [
|
|
19
|
+
{ action: 'create', resource: 'plugin' },
|
|
20
|
+
{ action: 'update', resource: 'plugin' },
|
|
21
|
+
{ action: 'delete', resource: 'plugin' },
|
|
22
|
+
],
|
|
15
23
|
},
|
|
16
24
|
{
|
|
17
25
|
role: 'EDITOR',
|
|
@@ -53,6 +61,11 @@ export class RBACService {
|
|
|
53
61
|
this.policy = policy ?? DEFAULT_POLICY;
|
|
54
62
|
}
|
|
55
63
|
hasPermission(userRoles, action, resource, context) {
|
|
64
|
+
// Denies vencem wildcard (ex.: TENANT_ADMIN vê plugins, não os gerencia) —
|
|
65
|
+
// exceto para o operador de plataforma, que a política nunca restringe.
|
|
66
|
+
if (!userRoles.includes('SUPER_ADMIN') && this.isDenied(userRoles, action, resource)) {
|
|
67
|
+
return false;
|
|
68
|
+
}
|
|
56
69
|
const allPermissions = this.resolvePermissions(userRoles);
|
|
57
70
|
return allPermissions.some(permission => {
|
|
58
71
|
// Check action match
|
|
@@ -70,6 +83,34 @@ export class RBACService {
|
|
|
70
83
|
return true;
|
|
71
84
|
});
|
|
72
85
|
}
|
|
86
|
+
isDenied(userRoles, action, resource) {
|
|
87
|
+
return this.walkRoles(userRoles, (rolePerms) => rolePerms.denies ?? []).some((deny) => {
|
|
88
|
+
const actionMatch = deny.action === '*' || deny.action === action;
|
|
89
|
+
const resourceMatch = deny.resource === '*' || deny.resource === resource;
|
|
90
|
+
return actionMatch && resourceMatch;
|
|
91
|
+
});
|
|
92
|
+
}
|
|
93
|
+
walkRoles(roles, extractor) {
|
|
94
|
+
const result = [];
|
|
95
|
+
const visited = new Set();
|
|
96
|
+
const resolve = (role) => {
|
|
97
|
+
if (visited.has(role))
|
|
98
|
+
return;
|
|
99
|
+
visited.add(role);
|
|
100
|
+
const rolePerms = this.policy.roles.find(r => r.role === role);
|
|
101
|
+
if (rolePerms) {
|
|
102
|
+
result.push(...extractor(rolePerms));
|
|
103
|
+
}
|
|
104
|
+
const inherited = this.policy.inheritance[role] ?? [];
|
|
105
|
+
for (const inheritedRole of inherited) {
|
|
106
|
+
resolve(inheritedRole);
|
|
107
|
+
}
|
|
108
|
+
};
|
|
109
|
+
for (const role of roles) {
|
|
110
|
+
resolve(role);
|
|
111
|
+
}
|
|
112
|
+
return result;
|
|
113
|
+
}
|
|
73
114
|
getUserPermissions(userRoles) {
|
|
74
115
|
return this.resolvePermissions(userRoles);
|
|
75
116
|
}
|
package/dist/rbac/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rbac/index.ts"],"names":[],"mappings":"AAAA,gDAAgD;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rbac/index.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAwBhD,MAAM,cAAc,GAAe;IACjC,KAAK,EAAE;QACL;YACE,IAAI,EAAE,aAAa;YACnB,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;SAC9C;QACD;YACE,IAAI,EAAE,cAAc;YACpB,oEAAoE;YACpE,kEAAkE;YAClE,qEAAqE;YACrE,iCAAiC;YACjC,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;YAC7C,wEAAwE;YACxE,wEAAwE;YACxE,sDAAsD;YACtD,MAAM,EAAE;gBACN,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE;gBACxC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE;gBACxC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE;aACzC;SACF;QACD;YACE,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE;gBACX,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE;gBACvC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE;gBACzC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE;gBACzC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE;gBACrC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE;aACxC;SACF;QACD;YACE,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE;gBACX,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE;gBACvC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE;gBACzC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBACpE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE;gBACrC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE;aACxC;SACF;QACD;YACE,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE;gBACX,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE;gBACvC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE;aACtC;SACF;KACF;IACD,WAAW,EAAE;QACX,YAAY,EAAE,CAAC,QAAQ,CAAC;QACxB,MAAM,EAAE,CAAC,QAAQ,CAAC;QAClB,MAAM,EAAE,CAAC,QAAQ,CAAC;KACnB;CACF,CAAC;AAEF,MAAM,OAAO,WAAW;IACd,MAAM,CAAa;IAE3B,YAAY,MAAmB;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,cAAc,CAAC;IACzC,CAAC;IAED,aAAa,CAAC,SAAmB,EAAE,MAAc,EAAE,QAAgB,EAAE,OAAiC;QACpG,2EAA2E;QAC3E,wEAAwE;QACxE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;YACrF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAE1D,OAAO,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;YACtC,qBAAqB;YACrB,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC;YAC9E,IAAI,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC;YAE/B,uBAAuB;YACvB,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC;YACtF,IAAI,CAAC,aAAa;gBAAE,OAAO,KAAK,CAAC;YAEjC,mBAAmB;YACnB,IAAI,UAAU,CAAC,UAAU,IAAI,OAAO,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC9D,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,QAAQ,CAAC,SAAmB,EAAE,MAAc,EAAE,QAAgB;QACpE,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACpF,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC;YAClE,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,KAAK,GAAG,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;YAC1E,OAAO,WAAW,IAAI,aAAa,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,SAAS,CAAC,KAAe,EAAE,SAAuD;QACxF,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAElC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE;YAC/B,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC9B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAElB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAC/D,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;YACvC,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACtD,KAAK,MAAM,aAAa,IAAI,SAAS,EAAE,CAAC;gBACtC,OAAO,CAAC,aAAa,CAAC,CAAC;YACzB,CAAC;QACH,CAAC,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kBAAkB,CAAC,SAAmB;QACpC,OAAO,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAEO,kBAAkB,CAAC,KAAe;QACxC,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAElC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE;YAC/B,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC9B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAElB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAC/D,IAAI,SAAS,EAAE,CAAC;gBACd,WAAW,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;YAC7C,CAAC;YAED,0BAA0B;YAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACtD,KAAK,MAAM,aAAa,IAAI,SAAS,EAAE,CAAC;gBACtC,OAAO,CAAC,aAAa,CAAC,CAAC;YACzB,CAAC;QACH,CAAC,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,eAAe,CAAC,UAAmC,EAAE,OAAgC;QAC3F,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACtD,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;gBAClB,sCAAsC;gBACtC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;oBACvE,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YACD,sCAAsC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@oktis-works/auth",
|
|
3
|
-
"version": "0.5.
|
|
3
|
+
"version": "0.5.6",
|
|
4
4
|
"private": false,
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./dist/index.js",
|
|
@@ -18,9 +18,9 @@
|
|
|
18
18
|
},
|
|
19
19
|
"dependencies": {
|
|
20
20
|
"@oktis-works/types": "^0.5.5",
|
|
21
|
-
"@oktis-works/config": "^0.
|
|
22
|
-
"@oktis-works/database": "^0.5.
|
|
23
|
-
"@oktis-works/core": "^0.5.
|
|
21
|
+
"@oktis-works/config": "^0.6.0",
|
|
22
|
+
"@oktis-works/database": "^0.5.8",
|
|
23
|
+
"@oktis-works/core": "^0.5.13"
|
|
24
24
|
},
|
|
25
25
|
"devDependencies": {
|
|
26
26
|
"typescript": "5.7.3",
|