@open-mercato/shared 0.6.7 → 0.6.8-develop.6874.1.982d6097d8

package/src/security/enabledModulesRegistry.ts

@@ -31,6 +31,7 @@ type FeatureRegistry = {
   enabledModuleSet: Set<string>
   featureToModule: Map<string, string>
   prefixToModule: Map<string, string>
+  concreteFeatureIds: string[]
 }
 
 let cachedRegistry: FeatureRegistry | null = null
@@ -41,23 +42,63 @@ function buildRegistry(modules: readonly Module[]): FeatureRegistry {
   const enabledModuleSet = new Set(enabledModuleIds)
   const featureToModule = new Map<string, string>()
   const prefixToModule = new Map<string, string>()
+  const concreteFeatureIds: string[] = []
+  const concreteFeatureSet = new Set<string>()
+
+  const addConcreteFeature = (featureId: string, owningModule: string, authoritative: boolean) => {
+    if (!featureId || featureId === '*' || featureId.endsWith('.*')) return
+    if (!concreteFeatureSet.has(featureId)) {
+      concreteFeatureSet.add(featureId)
+      concreteFeatureIds.push(featureId)
+    }
+    if (authoritative || !featureToModule.has(featureId)) {
+      featureToModule.set(featureId, owningModule)
+    }
+    const dot = featureId.indexOf('.')
+    if (dot > 0) {
+      const prefix = featureId.slice(0, dot)
+      if (!prefixToModule.has(prefix)) prefixToModule.set(prefix, owningModule)
+    }
+  }
+
   for (const mod of modules) {
     const features = mod.features
-    if (!Array.isArray(features)) continue
-    for (const feature of features) {
-      if (!feature || typeof feature.id !== 'string' || !feature.id) continue
-      const declared = typeof feature.module === 'string' && feature.module.length > 0
-        ? feature.module
-        : mod.id
-      featureToModule.set(feature.id, declared)
-      const dot = feature.id.indexOf('.')
-      if (dot > 0) {
-        const prefix = feature.id.slice(0, dot)
-        if (!prefixToModule.has(prefix)) prefixToModule.set(prefix, declared)
+    if (Array.isArray(features)) {
+      for (const feature of features) {
+        if (!feature || typeof feature.id !== 'string' || !feature.id) continue
+        const declared = typeof feature.module === 'string' && feature.module.length > 0
+          ? feature.module
+          : mod.id
+        addConcreteFeature(feature.id, declared, true)
+      }
+    }
+
+    const customerDefaults = mod.setup?.defaultCustomerRoleFeatures
+    if (customerDefaults) {
+      for (const roleFeatures of Object.values(customerDefaults)) {
+        if (!Array.isArray(roleFeatures)) continue
+        for (const featureId of roleFeatures) {
+          if (typeof featureId === 'string') addConcreteFeature(featureId, mod.id, false)
+        }
       }
     }
+
+    if (Array.isArray(mod.frontendRoutes)) {
+      for (const route of mod.frontendRoutes) {
+        if (!Array.isArray(route.requireCustomerFeatures)) continue
+        for (const featureId of route.requireCustomerFeatures) {
+          if (typeof featureId === 'string') addConcreteFeature(featureId, mod.id, false)
+        }
+      }
+    }
+  }
+  return {
+    enabledModuleIds,
+    enabledModuleSet,
+    featureToModule,
+    prefixToModule,
+    concreteFeatureIds,
   }
-  return { enabledModuleIds, enabledModuleSet, featureToModule, prefixToModule }
 }
 
 function getRegistry(): FeatureRegistry | null {
@@ -93,6 +134,17 @@ export function getEnabledModuleIds(): string[] {
   return registry ? [...registry.enabledModuleIds] : []
 }
 
+/** @internal Infrastructure input for concrete feature-policy projection. */
+export function getConcreteFeatureIds(): string[] {
+  const registry = getRegistry()
+  return registry ? [...registry.concreteFeatureIds] : []
+}
+
+/** @internal Distinguishes an empty registry from an unavailable bootstrap registry. */
+export function hasEnabledModulesRegistry(): boolean {
+  return getRegistry() !== null
+}
+
 /**
  * Filters a raw granted-features list down to the grants whose owning
  * module is currently enabled. Expands `*` (superadmin) into one wildcard

package/src/security/featurePolicy.ts

@@ -0,0 +1,89 @@
+import { hasAllFeatures as matchesAllFeatures } from './features'
+import {
+  filterGrantsByEnabledModules,
+  getConcreteFeatureIds,
+  getEnabledModuleIds,
+  getOwningModuleId,
+  hasEnabledModulesRegistry,
+} from './enabledModulesRegistry'
+import { composeAclFeatureOverrides } from '../modules/overrides'
+
+export type FeaturePolicySubject = {
+  grantedFeatures: readonly string[]
+  unrestricted?: boolean
+  scopeAllowed?: boolean
+}
+
+export function getRemovedAclFeatureIds(): string[] {
+  return Object.entries(composeAclFeatureOverrides())
+    .filter(([, override]) => override === null)
+    .map(([featureId]) => featureId)
+}
+
+export function isAclFeatureRemoved(featureId: string): boolean {
+  return composeAclFeatureOverrides()[featureId] === null
+}
+
+function isFeatureEnabled(featureId: string): boolean {
+  if (!hasEnabledModulesRegistry()) return true
+  const enabledModuleIds = getEnabledModuleIds()
+  return enabledModuleIds.includes(getOwningModuleId(featureId))
+}
+
+export function authorizeFeatures(
+  required: readonly string[],
+  subject: FeaturePolicySubject,
+): boolean {
+  if (required.length === 0) return true
+  if (subject.scopeAllowed === false) return false
+  if (required.some((featureId) => (
+    isAclFeatureRemoved(featureId) || !isFeatureEnabled(featureId)
+  ))) {
+    return false
+  }
+  if (subject.unrestricted === true) return true
+  return matchesAllFeatures(
+    filterGrantsByEnabledModules(subject.grantedFeatures),
+    required,
+  )
+}
+
+export function resolveEffectiveFeatures(
+  grantedFeatures: readonly string[],
+): string[] {
+  const filteredGrants = filterGrantsByEnabledModules(grantedFeatures)
+    .filter((featureId) => !isAclFeatureRemoved(featureId))
+
+  if (!hasEnabledModulesRegistry()) {
+    return filteredGrants.filter((featureId, index, features) => (
+      featureId !== '*'
+      && !featureId.endsWith('.*')
+      && features.indexOf(featureId) === index
+    ))
+  }
+
+  const result: string[] = []
+  const seen = new Set<string>()
+  const addFeature = (featureId: string) => {
+    if (
+      seen.has(featureId)
+      || isAclFeatureRemoved(featureId)
+      || !isFeatureEnabled(featureId)
+    ) {
+      return
+    }
+    seen.add(featureId)
+    result.push(featureId)
+  }
+
+  for (const featureId of getConcreteFeatureIds()) {
+    if (matchesAllFeatures(filteredGrants, [featureId])) addFeature(featureId)
+  }
+
+  for (const featureId of filteredGrants) {
+    if (featureId === '*' || featureId.endsWith('.*')) continue
+    addFeature(featureId)
+  }
+
+  return result
+}