@oondemand/oon-core-back 0.3.73 → 0.3.75

package/src/manifest/rbacManifest.js

@@ -0,0 +1,89 @@
+"use strict";
+
+const {
+  CORE_PERMISSIONS,
+  isPermission,
+  isRoleCode,
+} = require("../core/rbac/policy");
+
+function isPlainObject(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+function validateRbac(rbac, issues) {
+  if (rbac === undefined) return;
+  if (!isPlainObject(rbac)) {
+    issues.push({ path: "rbac", message: "deve ser um objeto." });
+    return;
+  }
+
+  const allowedKeys = new Set(["roles", "permissions", "invitationTtlHours"]);
+  for (const key of Object.keys(rbac)) {
+    if (!allowedKeys.has(key)) issues.push({ path: `rbac.${key}`, message: "propriedade não suportada." });
+  }
+
+  const customPermissions = Array.isArray(rbac.permissions) ? rbac.permissions : [];
+  if (rbac.permissions !== undefined && !Array.isArray(rbac.permissions)) {
+    issues.push({ path: "rbac.permissions", message: "deve ser uma lista." });
+  }
+  const seenPermissions = new Set();
+  customPermissions.forEach((permission, index) => {
+    if (!isPermission(permission) || permission === "*") {
+      issues.push({ path: `rbac.permissions[${index}]`, message: "deve usar o formato recurso.acao." });
+    } else if (seenPermissions.has(permission)) {
+      issues.push({ path: `rbac.permissions[${index}]`, message: `permissão duplicada: ${permission}.` });
+    }
+    seenPermissions.add(permission);
+  });
+
+  if (!Array.isArray(rbac.roles) || !rbac.roles.length) {
+    issues.push({ path: "rbac.roles", message: "deve conter ao menos um perfil." });
+    return;
+  }
+
+  const catalog = new Set([...CORE_PERMISSIONS, ...customPermissions]);
+  const seenRoles = new Set();
+  let adminCount = 0;
+  rbac.roles.forEach((role, index) => {
+    const base = `rbac.roles[${index}]`;
+    if (!isPlainObject(role)) {
+      issues.push({ path: base, message: "deve ser um objeto." });
+      return;
+    }
+    const allowedRoleKeys = new Set(["code", "name", "description", "permissions", "admin"]);
+    for (const key of Object.keys(role)) {
+      if (!allowedRoleKeys.has(key)) issues.push({ path: `${base}.${key}`, message: "propriedade não suportada." });
+    }
+    if (!isRoleCode(role.code)) issues.push({ path: `${base}.code`, message: "deve ser um código estável em minúsculas." });
+    if (seenRoles.has(role.code)) issues.push({ path: `${base}.code`, message: `perfil duplicado: ${role.code}.` });
+    seenRoles.add(role.code);
+    if (typeof role.name !== "string" || !role.name.trim()) issues.push({ path: `${base}.name`, message: "é obrigatório." });
+    if (role.admin !== undefined && typeof role.admin !== "boolean") issues.push({ path: `${base}.admin`, message: "deve ser booleano." });
+    if (!Array.isArray(role.permissions)) {
+      issues.push({ path: `${base}.permissions`, message: "deve ser uma lista." });
+      return;
+    }
+    const seenRolePermissions = new Set();
+    role.permissions.forEach((permission, permissionIndex) => {
+      const path = `${base}.permissions[${permissionIndex}]`;
+      if (!isPermission(permission)) issues.push({ path, message: "permissão inválida." });
+      else if (permission !== "*" && !catalog.has(permission)) issues.push({ path, message: `permissão não declarada: ${permission}.` });
+      if (seenRolePermissions.has(permission)) issues.push({ path, message: `permissão duplicada: ${permission}.` });
+      seenRolePermissions.add(permission);
+    });
+    if (role.permissions.includes("*") && role.admin !== true) {
+      issues.push({ path: `${base}.admin`, message: "deve ser true quando o perfil usa wildcard (*)." });
+    }
+    if (role.admin === true || role.permissions.includes("*")) adminCount += 1;
+  });
+
+  if (!adminCount) issues.push({ path: "rbac.roles", message: "deve existir ao menos um perfil administrativo." });
+
+  if (rbac.invitationTtlHours !== undefined) {
+    if (!Number.isInteger(rbac.invitationTtlHours) || rbac.invitationTtlHours < 1 || rbac.invitationTtlHours > 720) {
+      issues.push({ path: "rbac.invitationTtlHours", message: "deve ser inteiro entre 1 e 720 horas." });
+    }
+  }
+}
+
+module.exports = { validateRbac };