@open-mercato/core 0.6.1-develop.3102.d6e7e6d57a → 0.6.1-develop.3113.9d12cd20b0

package/src/modules/auth/api/users/route.ts

@@ -3,17 +3,18 @@ import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { logCrudAccess, makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'
-import { forbidden } from '@open-mercato/shared/lib/crud/errors'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { User, Role, UserRole } from '@open-mercato/core/modules/auth/data/entities'
-import { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import { Organization, Tenant } from '@open-mercato/core/modules/directory/data/entities'
 import { E } from '#generated/entities.ids.generated'
 import { loadCustomFieldValues } from '@open-mercato/shared/lib/crud/custom-fields'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { userCrudEvents, userCrudIndexer } from '@open-mercato/core/modules/auth/commands/users'
-import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { assertActorCanGrantRoleTokens } from '@open-mercato/core/modules/auth/lib/grantChecks'
+import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
 import { resolveSearchConfig } from '@open-mercato/shared/lib/search/config'
@@ -102,7 +103,7 @@ const crud = makeCrudRoute<CrudInput, CrudInput, Record<string, unknown>>({
       schema: rawBodySchema,
       mapInput: async ({ parsed, ctx }) => {
         if (ctx.request) {
-          await assertCanAssignRoles(ctx.request, parsed.roles)
+          await assertCanAssignRoles(ctx.request, parsed.roles, parsed)
         }
         return parsed
       },
@@ -117,7 +118,7 @@ const crud = makeCrudRoute<CrudInput, CrudInput, Record<string, unknown>>({
       schema: rawBodySchema,
       mapInput: async ({ parsed, ctx }) => {
         if (ctx.request) {
-          await assertCanAssignRoles(ctx.request, parsed.roles)
+          await assertCanAssignRoles(ctx.request, parsed.roles, parsed)
         }
         return parsed
       },
@@ -371,14 +372,10 @@ export async function GET(req: Request) {
 }
 
 export const POST = async (req: Request) => {
-  const body = await req.clone().json().catch(() => ({}))
-  await assertCanAssignRoles(req, body?.roles)
   return crud.POST(req)
 }
 
 export const PUT = async (req: Request) => {
-  const body = await req.clone().json().catch(() => ({}))
-  await assertCanAssignRoles(req, body?.roles)
   return crud.PUT(req)
 }
 
@@ -414,35 +411,53 @@ async function findUserIdsBySearchTokens(
     .filter((id): id is string => typeof id === 'string' && id.length > 0)
 }
 
-const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
-
-async function assertCanAssignRoles(req: Request, roles: unknown) {
+async function assertCanAssignRoles(req: Request, roles: unknown, payload: Record<string, unknown>) {
   if (!Array.isArray(roles)) return
-  const values = roles
-    .map((role) => (typeof role === 'string' ? role.trim() : null))
-    .filter((role): role is string => !!role)
-  if (!values.length) return
+  const auth = await getAuthFromRequest(req)
+  if (!auth?.sub) throw new CrudHttpError(401, { error: 'Unauthorized' })
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+  const tenantId = await resolveTargetTenantIdForRoleGrant(em, payload, auth.tenantId ?? null)
+  await assertActorCanGrantRoleTokens({
+    em,
+    rbacService: container.resolve('rbacService') as RbacService,
+    actorUserId: auth.sub,
+    tenantId,
+    organizationId: auth.orgId ?? null,
+    roleTokens: roles,
+  })
+}
 
-  let hasSuperAdmin = values.some((v) => v.toLowerCase() === 'superadmin')
-  if (!hasSuperAdmin) {
-    const uuids = values.filter((v) => UUID_RE.test(v))
-    if (uuids.length) {
-      const container = await createRequestContainer()
-      const em = container.resolve('em') as EntityManager
-      const matched = await em.find(Role, { id: { $in: uuids as any } })
-      hasSuperAdmin = matched.some((r) => String(r.name).toLowerCase() === 'superadmin')
-    }
+async function resolveTargetTenantIdForRoleGrant(
+  em: EntityManager,
+  payload: Record<string, unknown>,
+  fallbackTenantId: string | null,
+): Promise<string | null> {
+  const organizationId = typeof payload.organizationId === 'string' ? payload.organizationId : null
+  if (organizationId) {
+    const organization = await findOneWithDecryption(
+      em,
+      Organization,
+      { id: organizationId },
+      { populate: ['tenant'] },
+      { tenantId: null, organizationId },
+    )
+    return organization?.tenant?.id ? String(organization.tenant.id) : fallbackTenantId
   }
-  if (!hasSuperAdmin) return
 
-  const auth = await getAuthFromRequest(req)
-  if (!auth) throw new Error('Unauthorized')
-  const container = await createRequestContainer()
-  const rbac = container.resolve('rbacService') as RbacService
-  const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })
-  if (!acl?.isSuperAdmin) {
-    throw forbidden('Only super administrators can assign the superadmin role.')
+  const userId = typeof payload.id === 'string' ? payload.id : null
+  if (userId) {
+    const user = await findOneWithDecryption(
+      em,
+      User,
+      { id: userId, deletedAt: null },
+      {},
+      { tenantId: null, organizationId: null },
+    )
+    return user?.tenantId ? String(user.tenantId) : fallbackTenantId
   }
+
+  return fallbackTenantId
 }
 
 export const openApi: OpenApiRouteDoc = {

package/src/modules/auth/lib/grantChecks.ts

@@ -0,0 +1,234 @@
+import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
+import { CrudHttpError, forbidden } from '@open-mercato/shared/lib/crud/errors'
+import { hasFeature } from '@open-mercato/shared/security/features'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { Role, RoleAcl } from '@open-mercato/core/modules/auth/data/entities'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+
+type ActorAcl = {
+  isSuperAdmin: boolean
+  features: string[]
+  organizations: string[] | null
+}
+
+type GrantCheckContext = {
+  em: EntityManager
+  rbacService: RbacService
+  actorUserId: string | null | undefined
+  tenantId: string | null | undefined
+  organizationId?: string | null | undefined
+}
+
+type RoleGrantCheckInput = GrantCheckContext & {
+  roles: Role[]
+}
+
+type RoleTokenGrantCheckInput = GrantCheckContext & {
+  roleTokens: unknown
+}
+
+type FeatureGrantCheckInput = GrantCheckContext & {
+  features: unknown
+  isSuperAdmin?: boolean
+  organizations?: string[] | null
+}
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
+
+export async function assertActorCanGrantRoleTokens(input: RoleTokenGrantCheckInput): Promise<Role[]> {
+  const tokens = normalizeStringList(input.roleTokens)
+  if (!tokens.length) return []
+
+  const tenantId = normalizeNullableString(input.tenantId)
+  const roles = await resolveRolesForGrant(input.em, tokens, tenantId)
+  await assertActorCanGrantRoles({ ...input, tenantId, roles })
+  return roles
+}
+
+export async function assertActorCanGrantRoles(input: RoleGrantCheckInput): Promise<void> {
+  if (!input.roles.length) return
+
+  const tenantId = normalizeNullableString(input.tenantId)
+  const actorAcl = await loadActorAcl({ ...input, tenantId })
+  if (actorAcl.isSuperAdmin) return
+
+  if (!tenantId) {
+    throw forbidden('Tenant context is required to grant roles.')
+  }
+
+  for (const role of input.roles) {
+    const roleTenantId = normalizeNullableString(role.tenantId)
+    if (roleTenantId !== tenantId) {
+      throw forbidden('Cannot grant a role outside the target tenant.')
+    }
+
+    const acl = await findOneWithDecryption(
+      input.em,
+      RoleAcl,
+      { role, tenantId } as FilterQuery<RoleAcl>,
+      {},
+      { tenantId, organizationId: null },
+    )
+    if (!acl) continue
+
+    assertActorCanGrantAclSnapshot(actorAcl, {
+      isSuperAdmin: !!acl.isSuperAdmin,
+      features: normalizeStringList(acl.featuresJson),
+      organizations: normalizeOrganizationList(acl.organizationsJson),
+    })
+  }
+}
+
+export async function assertActorCanGrantAcl(input: FeatureGrantCheckInput): Promise<void> {
+  const actorAcl = await loadActorAcl(input)
+  if (actorAcl.isSuperAdmin) return
+
+  const tenantId = normalizeNullableString(input.tenantId)
+  if (!tenantId) {
+    throw forbidden('Tenant context is required to grant ACL features.')
+  }
+
+  assertActorCanGrantAclSnapshot(actorAcl, {
+    isSuperAdmin: !!input.isSuperAdmin,
+    features: normalizeStringList(input.features),
+    organizations: input.organizations === undefined ? undefined : normalizeOrganizationList(input.organizations),
+  })
+}
+
+export function normalizeGrantFeatureList(features: unknown): string[] {
+  return normalizeStringList(features)
+}
+
+async function loadActorAcl(input: GrantCheckContext): Promise<ActorAcl> {
+  const actorUserId = normalizeNullableString(input.actorUserId)
+  if (!actorUserId) throw forbidden('Not authorized to grant ACL privileges.')
+
+  const acl = await input.rbacService.loadAcl(actorUserId, {
+    tenantId: normalizeNullableString(input.tenantId),
+    organizationId: normalizeNullableString(input.organizationId),
+  })
+
+  return {
+    isSuperAdmin: !!acl?.isSuperAdmin,
+    features: normalizeStringList(acl?.features),
+    organizations: normalizeOrganizationList(acl?.organizations),
+  }
+}
+
+async function resolveRolesForGrant(
+  em: EntityManager,
+  roleTokens: string[],
+  tenantId: string | null,
+): Promise<Role[]> {
+  const roles: Role[] = []
+  const missingRoles: string[] = []
+
+  for (const token of roleTokens) {
+    const role = await resolveRoleForGrant(em, token, tenantId)
+    if (!role) {
+      missingRoles.push(token)
+    } else {
+      roles.push(role)
+    }
+  }
+
+  if (missingRoles.length) {
+    const labels = missingRoles.map((role) => `"${role}"`).join(', ')
+    throw new CrudHttpError(400, { error: `Role(s) not found: ${labels}` })
+  }
+
+  return roles
+}
+
+async function resolveRoleForGrant(
+  em: EntityManager,
+  token: string,
+  tenantId: string | null,
+): Promise<Role | null> {
+  const where: Record<string, unknown> = UUID_RE.test(token)
+    ? { id: token, deletedAt: null }
+    : { name: token, deletedAt: null }
+  if (tenantId) where.tenantId = tenantId
+  return findOneWithDecryption(
+    em,
+    Role,
+    where as FilterQuery<Role>,
+    {},
+    { tenantId, organizationId: null },
+  )
+}
+
+function assertActorCanGrantAclSnapshot(
+  actorAcl: ActorAcl,
+  requested: {
+    isSuperAdmin: boolean
+    features: string[]
+    organizations?: string[] | null
+  },
+): void {
+  if (requested.isSuperAdmin) {
+    throw forbidden('Only super administrators can grant super admin access.')
+  }
+
+  const actorGrantableFeatures = actorAcl.features.filter((grant) => grant !== '*')
+  for (const feature of requested.features) {
+    if (feature === '*') {
+      throw forbidden('Only super administrators can grant global wildcard access.')
+    }
+    if (isWildcardFeature(feature)) {
+      if (!hasFeature(actorGrantableFeatures, feature)) {
+        throw forbidden(`Cannot grant feature wildcard ${feature}.`)
+      }
+      continue
+    }
+    if (!hasFeature(actorGrantableFeatures, feature)) {
+      throw forbidden(`Cannot grant feature ${feature}.`)
+    }
+  }
+
+  if (requested.organizations !== undefined) {
+    assertActorCanGrantOrganizations(actorAcl.organizations, requested.organizations)
+  }
+}
+
+function assertActorCanGrantOrganizations(
+  actorOrganizations: string[] | null,
+  requestedOrganizations: string[] | null,
+): void {
+  if (actorOrganizations === null || actorOrganizations.includes('__all__')) return
+
+  if (requestedOrganizations === null || requestedOrganizations.includes('__all__')) {
+    throw forbidden('Cannot grant unrestricted organization access.')
+  }
+
+  for (const organizationId of requestedOrganizations) {
+    if (!actorOrganizations.includes(organizationId)) {
+      throw forbidden('Cannot grant organization access outside actor scope.')
+    }
+  }
+}
+
+function normalizeStringList(values: unknown): string[] {
+  if (!Array.isArray(values)) return []
+  const dedup = new Set<string>()
+  for (const value of values) {
+    if (typeof value !== 'string') continue
+    const trimmed = value.trim()
+    if (!trimmed) continue
+    dedup.add(trimmed)
+  }
+  return Array.from(dedup)
+}
+
+function normalizeOrganizationList(values: unknown): string[] | null {
+  if (values === null || values === undefined) return null
+  return normalizeStringList(values)
+}
+
+function normalizeNullableString(value: unknown): string | null {
+  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null
+}
+
+function isWildcardFeature(feature: string): boolean {
+  return feature.endsWith('.*')
+}