@owlmeans/server-iam 0.1.18-rc.15 → 0.1.18-rc.16
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/agent-meta/manifest.json +2 -2
- package/agent-meta/skills/server-iam/SKILL.md +57 -9
- package/build/gate.d.ts.map +1 -1
- package/build/gate.js +5 -1
- package/build/gate.js.map +1 -1
- package/package.json +8 -8
- package/src/gate.ts +5 -1
package/agent-meta/manifest.json
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schemaVersion": 2,
|
|
3
3
|
"package": "@owlmeans/server-iam",
|
|
4
|
-
"version": "0.1.18-rc.
|
|
5
|
-
"generatedAt": "2026-08-
|
|
4
|
+
"version": "0.1.18-rc.15",
|
|
5
|
+
"generatedAt": "2026-08-29T20:14:19.665Z",
|
|
6
6
|
"canonicalRepo": "https://github.com/owlmeans/common",
|
|
7
7
|
"entries": [
|
|
8
8
|
{
|
|
@@ -16,22 +16,58 @@ IAM gate; the consumer never knows which IAM backend (Keycloak or integrated) is
|
|
|
16
16
|
| Symbol | Kind | Purpose |
|
|
17
17
|
|--------|------|---------|
|
|
18
18
|
| `appendIam(context)` | fn | Registers `makeOidcClientService()`, `makeOidcWrappingService()`, `makeIamGate()` (under `OIDC_GATE`), and the OIDC guard |
|
|
19
|
-
| `makeIamGate(alias?)` | fn | The IAM `GateService` — claims-first assertion with UMA2 fallback |
|
|
20
|
-
| `parseGateParam
|
|
21
|
-
| `RESOURCE_PARAM_SEPARATOR` | const | `'@'
|
|
19
|
+
| `makeIamGate(alias?, opts?)` | fn | The IAM `GateService` — claims-first assertion with UMA2 fallback. `opts.strictResourceScope` refuses a scoped param on the fallback path instead of widening it |
|
|
20
|
+
| `parseGateParam` / `formatGateParam` / `resolveGateResource` / `validateGateParams` | fn | Re-exports from `@owlmeans/iam`, which owns the grammar |
|
|
21
|
+
| `RESOURCE_PARAM_SEPARATOR` | const | `'@'`, re-exported |
|
|
22
22
|
| `hasPermission` | fn | Re-export from `@owlmeans/iam` |
|
|
23
23
|
|
|
24
|
+
The grammar lives in **`@owlmeans/iam`**, not here — the browser, both IAM adapters and
|
|
25
|
+
code-generation tooling all have to read the same rules. This package re-exports it because this was
|
|
26
|
+
its original home.
|
|
27
|
+
|
|
24
28
|
## Gate-param syntax
|
|
25
29
|
|
|
26
30
|
```
|
|
27
|
-
<permission>
|
|
28
|
-
<permission>@<
|
|
31
|
+
<permission> → unscoped (project-wide): 'article--modify'
|
|
32
|
+
<permission>@<bareKey> → bare form: 'department--modify@departmentId'
|
|
33
|
+
<permission>@<source>:<path> → qualified form: 'order--modify@body:order.id'
|
|
29
34
|
```
|
|
30
35
|
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
36
|
+
Sources: `params`, `query`, `body`, `headers`, `auth`.
|
|
37
|
+
|
|
38
|
+
- **The bare form is lenient and flat**; the qualified form is strict and nested. `@a.b` in the bare
|
|
39
|
+
form is the literal key `"a.b"` — a query key may legally contain a dot, and splitting it would
|
|
40
|
+
change what already-deployed selectors mean. Dotted paths exist only after a `source:`.
|
|
41
|
+
- The separator is `:` and not a dot on purpose. With a dotted-only form, a route that gains a param
|
|
42
|
+
named like a source keyword silently changes a selector's meaning: `/report/:query` with
|
|
43
|
+
`@query.id` flips from "the route param named `query.id`" to "the query string's `id`" — an
|
|
44
|
+
authorization lookup redirected to attacker-supplied input by an unrelated route rename.
|
|
45
|
+
- The bare form searches `params` then `query`. That query fallback is legacy and deliberately kept:
|
|
46
|
+
removing it would silently deny deployed apps whose selector names a query key.
|
|
47
|
+
- `headers:` lowercases its first segment and unwraps a single-element array; a repeated header is
|
|
48
|
+
refused rather than silently narrowed to one of its values.
|
|
49
|
+
- `auth:` is the only source that is neither attacker-controlled nor subject to `removeAdditional`.
|
|
50
|
+
Prefer it whenever the rule is "bound to their own profile or entity".
|
|
51
|
+
- A resolved id must satisfy the grant's `resources[]` — **and a grant carrying no `resources` at all
|
|
52
|
+
covers every id**. That is the all-resources form of the same permission, not a separate one.
|
|
53
|
+
- Params are **any-of**: one granted param is enough. Which is why a malformed or unresolvable param
|
|
54
|
+
can only contribute `false` and never throw — otherwise one bad sibling would refuse a request the
|
|
55
|
+
subject is legitimately entitled to.
|
|
56
|
+
|
|
57
|
+
**The `@` belongs to the gate and nowhere else.** It is never part of a permission's stored NAME. A
|
|
58
|
+
definition or grant written as `enquiry--view@enquiryId` is a key nothing looks up, so the permission
|
|
59
|
+
reads as granted in every screen and every request is still refused, with nothing logged.
|
|
60
|
+
`ensurePermission` refuses such a name; `validateGateParams` catches the mirror-image mistake at
|
|
61
|
+
generation time.
|
|
62
|
+
|
|
63
|
+
### `validateGateParams(params, audit?)`
|
|
64
|
+
|
|
65
|
+
Reports what is provable from an entrypoint's own declaration: a selector naming a route param the
|
|
66
|
+
path does not carry, or a `body`/`query`/`headers` key the `Filter` does not declare **while that
|
|
67
|
+
schema sets `additionalProperties: false`**. That qualifier matters — the server's AJV runs
|
|
68
|
+
`removeAdditional`, which strips only what a schema closes, so without it the check would fire on
|
|
69
|
+
every unfiltered endpoint and be ignored within a week. It never decides a request; the gate runs it
|
|
70
|
+
once per alias and only logs.
|
|
35
71
|
|
|
36
72
|
```ts
|
|
37
73
|
// module declaration
|
|
@@ -51,6 +87,18 @@ await ctx.service<GateService>(OIDC_GATE).assert(req, res, ['article--modify'])
|
|
|
51
87
|
from `@owlmeans/server-oidc-rp` (`createGateModel().loadPermissions`) — byte-equivalent to the old
|
|
52
88
|
`makeOidcGate`, which keeps Keycloak-backed deployments unchanged.
|
|
53
89
|
|
|
90
|
+
**Known limitation of `IAM_MODE=keycloak`:** resource scoping is *not enforced* on the fallback path,
|
|
91
|
+
so one declaration means two different things depending on the active backend. It cannot be fixed by
|
|
92
|
+
denying — `iam-keycloak` throws `IamUnsupported('resource-scoped-grant')`, so a scoped grant cannot
|
|
93
|
+
exist there and denying would lock every user out of every scoped endpoint. The gate logs each such
|
|
94
|
+
param once per alias; `makeIamGate(alias, { strictResourceScope: true })` opts into denial where the
|
|
95
|
+
refusals are the intended outcome.
|
|
96
|
+
|
|
97
|
+
A denial distinguishes its reasons in the log: a param that failed **structurally** (unparseable,
|
|
98
|
+
source absent, value not a scalar) is reported separately from one that resolved fine and simply was
|
|
99
|
+
not granted. The HTTP answer is identical — `AuthForbidden('permission')` either way — because the
|
|
100
|
+
caller must never learn which.
|
|
101
|
+
|
|
54
102
|
## Rules
|
|
55
103
|
|
|
56
104
|
- Register the gate via `appendIam()`; do not also register `makeOidcGate()` — both use the
|
package/build/gate.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAqC,MAAM,sBAAsB,CAAA;
|
|
1
|
+
{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAqC,MAAM,sBAAsB,CAAA;AAY1F;;;;GAIG;AACH,OAAO,EACL,wBAAwB,EAAE,yBAAyB,EAAE,uBAAuB,EAC5E,eAAe,EAAE,kBAAkB,EAAE,qBAAqB,EAC1D,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,mBAAmB,EAAE,kBAAkB,EAC5F,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE1F,MAAM,WAAW,cAAc;IAC7B;;;;;;;;OAQG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAC9B;AA2DD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,WAAW,WAAW,MAAM,SAAqB,cAAc,KAAG,WA4F9E,CAAA"}
|
package/build/gate.js
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import { createLazyService } from '@owlmeans/context';
|
|
2
|
+
import { entitySlugOf } from '@owlmeans/auth';
|
|
2
3
|
import { OIDC_GATE } from '@owlmeans/oidc';
|
|
3
4
|
import { AuthForbidden } from '@owlmeans/auth';
|
|
4
5
|
import { createGateModel, extractPermissionSets } from '@owlmeans/server-oidc-rp';
|
|
@@ -90,7 +91,10 @@ export const makeIamGate = (alias = OIDC_GATE, opts) => {
|
|
|
90
91
|
const structural = [];
|
|
91
92
|
const granted = params.some(param => {
|
|
92
93
|
const { permission, resource, error } = parseGateParam(param);
|
|
93
|
-
|
|
94
|
+
// Grants are stored against the entity's stable id wherever one is resolvable; the
|
|
95
|
+
// slug is only a fallback for deployments with no organization store of their own,
|
|
96
|
+
// where the slug IS the identifier.
|
|
97
|
+
const fixed = permission.replaceAll('{entity}', req.entity?.id ?? entitySlugOf(auth) ?? '-');
|
|
94
98
|
if (error != null) {
|
|
95
99
|
structural.push(`"${param}" does not parse [${error.code}]: ${error.detail}`);
|
|
96
100
|
return false;
|
package/build/gate.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"gate.js","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAErD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAE9C,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAA;AAEjF,OAAO,EACL,aAAa,EAAE,cAAc,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,qBAAqB,EAC9F,MAAM,eAAe,CAAA;AAGtB;;;;GAIG;AACH,OAAO,EACL,wBAAwB,EAAE,yBAAyB,EAAE,uBAAuB,EAC5E,eAAe,EAAE,kBAAkB,EAAE,qBAAqB,EAC1D,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,mBAAmB,EAAE,kBAAkB,EAC5F,MAAM,eAAe,CAAA;AAgBtB;;;;;GAKG;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;AAElC,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,OAAe,EAAQ,EAAE;IACxD,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAM;IACR,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACjB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;AACxB,CAAC,CAAA;AAED,4DAA4D;AAC5D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;AAEjC;;;;;;;GAOG;AACH,MAAM,eAAe,GAAG,CAAC,GAAY,EAAE,GAAoB,EAAE,MAAgB,EAAQ,EAAE;IACrF,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,OAAM;IACR,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAEtB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAmB,GAAG,CAAC,KAAK,CAAC,CAAA;QAC9D,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YACvB,OAAM;QACR,CAAC;QAED,MAAM,KAAK,GAAmB;YAC5B,GAAG,CAAC,OAAQ,UAAkB,CAAC,OAAO,KAAK,UAAU;gBACnD,CAAC,CAAC,EAAE,SAAS,EAAG,UAAkB,CAAC,OAAO,EAAY,EAAE;gBACxD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAkC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChG,CAAA;QAED,KAAK,MAAM,KAAK,IAAI,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;YACtD,OAAO,CAAC,KAAK,CACX,eAAe,KAAK,CAAC,KAAK,oBAAoB,GAAG,CAAC,KAAK,oBAAoB;kBACzE,KAAK,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,MAAM,EAAE,CACtC,CAAA;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8EAA8E;IAChF,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,GAAW,SAAS,EAAE,IAAqB,EAAe,EAAE;IAC3F,MAAM,OAAO,GAAgB,iBAAiB,CAAc,KAAK,EAAE;QACjE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE;YAC/B,MAAM,OAAO,CAAC,KAAK,EAAE,CAAA;YACrB,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YAEhD,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,CAAA;YACjC,CAAC;YAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAAY,CAAA;YAC7B,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YAEpD,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;gBACjB,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;gBAEjC,2FAA2F;gBAC3F,sFAAsF;gBACtF,2CAA2C;gBAC3C,MAAM,UAAU,GAAa,EAAE,CAAA;gBAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;oBAClC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;oBAC7D,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,
|
|
1
|
+
{"version":3,"file":"gate.js","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAErD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAE9C,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAA;AAEjF,OAAO,EACL,aAAa,EAAE,cAAc,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,qBAAqB,EAC9F,MAAM,eAAe,CAAA;AAGtB;;;;GAIG;AACH,OAAO,EACL,wBAAwB,EAAE,yBAAyB,EAAE,uBAAuB,EAC5E,eAAe,EAAE,kBAAkB,EAAE,qBAAqB,EAC1D,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,mBAAmB,EAAE,kBAAkB,EAC5F,MAAM,eAAe,CAAA;AAgBtB;;;;;GAKG;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;AAElC,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,OAAe,EAAQ,EAAE;IACxD,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAM;IACR,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACjB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;AACxB,CAAC,CAAA;AAED,4DAA4D;AAC5D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;AAEjC;;;;;;;GAOG;AACH,MAAM,eAAe,GAAG,CAAC,GAAY,EAAE,GAAoB,EAAE,MAAgB,EAAQ,EAAE;IACrF,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,OAAM;IACR,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAEtB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAmB,GAAG,CAAC,KAAK,CAAC,CAAA;QAC9D,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YACvB,OAAM;QACR,CAAC;QAED,MAAM,KAAK,GAAmB;YAC5B,GAAG,CAAC,OAAQ,UAAkB,CAAC,OAAO,KAAK,UAAU;gBACnD,CAAC,CAAC,EAAE,SAAS,EAAG,UAAkB,CAAC,OAAO,EAAY,EAAE;gBACxD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAkC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChG,CAAA;QAED,KAAK,MAAM,KAAK,IAAI,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;YACtD,OAAO,CAAC,KAAK,CACX,eAAe,KAAK,CAAC,KAAK,oBAAoB,GAAG,CAAC,KAAK,oBAAoB;kBACzE,KAAK,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,MAAM,EAAE,CACtC,CAAA;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8EAA8E;IAChF,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,GAAW,SAAS,EAAE,IAAqB,EAAe,EAAE;IAC3F,MAAM,OAAO,GAAgB,iBAAiB,CAAc,KAAK,EAAE;QACjE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE;YAC/B,MAAM,OAAO,CAAC,KAAK,EAAE,CAAA;YACrB,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YAEhD,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,CAAA;YACjC,CAAC;YAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAAY,CAAA;YAC7B,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YAEpD,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;gBACjB,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;gBAEjC,2FAA2F;gBAC3F,sFAAsF;gBACtF,2CAA2C;gBAC3C,MAAM,UAAU,GAAa,EAAE,CAAA;gBAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;oBAClC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;oBAC7D,mFAAmF;oBACnF,mFAAmF;oBACnF,oCAAoC;oBACpC,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAA;oBAE5F,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;wBAClB,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,qBAAqB,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;wBAC7E,OAAO,KAAK,CAAA;oBACd,CAAC;oBAED,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;wBACrB,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;wBACrD,IAAI,UAAU,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;4BAC1B,IAAI,UAAU,CAAC,MAAM,KAAK,qBAAqB,CAAC,WAAW,EAAE,CAAC;gCAC5D,UAAU,CAAC,IAAI,CACb,IAAI,KAAK,8BAA8B,UAAU,CAAC,MAAM,GAAG;sCACzD,SAAS,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzC,CAAA;4BACH,CAAC;4BACD,OAAO,KAAK,CAAA;wBACd,CAAC;wBAED,OAAO,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAA;oBAClE,CAAC;oBAED,OAAO,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;gBACnC,CAAC,CAAC,CAAA;gBAEF,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CACrC,GAAG,GAAG,CAAC,KAAK,KAAK,MAAM,EAAE,EACzB,uBAAuB,GAAG,CAAC,KAAK,8CAA8C,MAAM,EAAE,CACvF,CAAC,CAAA;oBAEF,MAAM,IAAI,aAAa,CAAC,YAAY,CAAC,CAAA;gBACvC,CAAC;gBAED,OAAM;YACR,CAAC;YAED,4FAA4F;YAC5F,+FAA+F;YAC/F,+EAA+E;YAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAA;YAC7E,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAChC,SAAS,GAAG,CAAC,KAAK,KAAK,KAAK,EAAE,EAC9B,eAAe,KAAK,oBAAoB,GAAG,CAAC,KAAK,4CAA4C;kBAC3F,4EAA4E,CAC/E,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,IAAI,EAAE,mBAAmB,KAAK,IAAI;gBAC/C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC;gBAChE,CAAC,CAAC,MAAM,CAAA;YAEV,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,aAAa,CAAC,YAAY,CAAC,CAAA;YACvC,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAA;YACtE,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YAE/D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,aAAa,CAAC,YAAY,CAAC,CAAA;YACvC,CAAC;QACH,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@owlmeans/server-iam",
|
|
3
|
-
"version": "0.1.18-rc.
|
|
3
|
+
"version": "0.1.18-rc.16",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"scripts": {
|
|
@@ -22,17 +22,17 @@
|
|
|
22
22
|
}
|
|
23
23
|
},
|
|
24
24
|
"dependencies": {
|
|
25
|
-
"@owlmeans/auth": "^0.1.18-rc.
|
|
25
|
+
"@owlmeans/auth": "^0.1.18-rc.7",
|
|
26
26
|
"@owlmeans/context": "^0.1.18-rc.6",
|
|
27
|
-
"@owlmeans/entrypoint": "^0.1.18-rc.
|
|
28
|
-
"@owlmeans/iam": "^0.1.18-rc.
|
|
29
|
-
"@owlmeans/oidc": "^0.1.18-rc.
|
|
30
|
-
"@owlmeans/server-context": "^0.1.18-rc.
|
|
31
|
-
"@owlmeans/server-oidc-rp": "^0.1.18-rc.
|
|
27
|
+
"@owlmeans/entrypoint": "^0.1.18-rc.8",
|
|
28
|
+
"@owlmeans/iam": "^0.1.18-rc.12",
|
|
29
|
+
"@owlmeans/oidc": "^0.1.18-rc.9",
|
|
30
|
+
"@owlmeans/server-context": "^0.1.18-rc.8",
|
|
31
|
+
"@owlmeans/server-oidc-rp": "^0.1.18-rc.13"
|
|
32
32
|
},
|
|
33
33
|
"devDependencies": {
|
|
34
34
|
"@owlmeans/dep-config": "workspace:*",
|
|
35
|
-
"@types/bun": "^1.
|
|
35
|
+
"@types/bun": "^1.4.0",
|
|
36
36
|
"nodemon": "^3.1.14",
|
|
37
37
|
"typescript": "^7.0.2"
|
|
38
38
|
},
|
package/src/gate.ts
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { createLazyService } from '@owlmeans/context'
|
|
2
2
|
import type { GateService, AbstractRequest, CommonEntrypoint } from '@owlmeans/entrypoint'
|
|
3
|
+
import { entitySlugOf } from '@owlmeans/auth'
|
|
3
4
|
import { OIDC_GATE } from '@owlmeans/oidc'
|
|
4
5
|
import { AuthForbidden } from '@owlmeans/auth'
|
|
5
6
|
import type { Auth } from '@owlmeans/auth'
|
|
@@ -129,7 +130,10 @@ export const makeIamGate = (alias: string = OIDC_GATE, opts?: IamGateOptions): G
|
|
|
129
130
|
|
|
130
131
|
const granted = params.some(param => {
|
|
131
132
|
const { permission, resource, error } = parseGateParam(param)
|
|
132
|
-
|
|
133
|
+
// Grants are stored against the entity's stable id wherever one is resolvable; the
|
|
134
|
+
// slug is only a fallback for deployments with no organization store of their own,
|
|
135
|
+
// where the slug IS the identifier.
|
|
136
|
+
const fixed = permission.replaceAll('{entity}', req.entity?.id ?? entitySlugOf(auth) ?? '-')
|
|
133
137
|
|
|
134
138
|
if (error != null) {
|
|
135
139
|
structural.push(`"${param}" does not parse [${error.code}]: ${error.detail}`)
|