@open-rlb/ng-app 3.1.90 → 3.1.91

package/fesm2022/open-rlb-ng-app.mjs

@@ -571,6 +571,23 @@ class AppsService {
             return false;
         return this.aclStore.hasPermission(info.busId, info.resId, action);
     }
+    /**
+     * Finds the app that owns a given route path string (e.g. 'some-page/sub-page').
+     * Used by permissionGuard on initial deep-link navigation, before NavigationEnd has
+     * fired and currentApp has been selected by the router listener.
+     */
+    findAppForPath(path) {
+        return this.apps().find((app) => app.routes?.some((r) => r === path || path.startsWith(r + '/') || r.startsWith(path + '/')) ||
+            app.core?.url === '/' + path ||
+            (app.core?.url && path.startsWith(app.core.url.replace(/^\//, ''))));
+    }
+    checkPermissionForApp(app, action) {
+        if (!app?.data || !this.confAcl)
+            return false;
+        const busId = app.data[this.confAcl.businessIdKey];
+        const resId = app.data[this.confAcl.resourceIdKey];
+        return this.aclStore.hasPermission(busId, resId, action);
+    }
     selectApp(app, viewMode, url) {
         const currentApp = this.currentApp();
         if (!app) {
@@ -2768,14 +2785,26 @@ const oauthGuard = (route, state) => {
     }));
 };
 
-const permissionGuard = (route) => {
+const permissionGuard = route => {
     const aclStore = inject(AclStore);
     const appsService = inject(AppsService);
     const router = inject(Router);
-    // We wait for aclStore to load data
     return toObservable(aclStore.loaded).pipe(filter(Boolean), take(1), map(() => {
         const action = route.data['action'];
-        if (appsService.checkPermissionInCurrentApp(action)) {
+        // Default case: currentApp already selected (any navigation after the first).
+        if (appsService.currentApp()) {
+            return appsService.checkPermissionInCurrentApp(action)
+                ? true
+                : router.createUrlTree(['/forbidden']);
+        }
+        // Deep-link case: currentApp still not processed by AppsService, so we extract ACL data from route and check permissions
+        const routePath = route.pathFromRoot
+            .flatMap(r => r.url)
+            .map(seg => seg.path)
+            .filter(Boolean)
+            .join('/');
+        const resolvedApp = appsService.findAppForPath(routePath);
+        if (resolvedApp && appsService.checkPermissionForApp(resolvedApp, action)) {
             return true;
         }
         return router.createUrlTree(['/forbidden']);