@pcg/auth 1.0.0-alpha.0

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":["scopes","scopes: (string | string[])[]","resolvedPermissions: ResolvedPermission[]","result: ResolvedPermission[]","result: (string | string[])[]","scopes: (string | string[])[]","result: (string | string[])[]"],"sources":["../src/permissions/action-scopes.ts","../src/permissions/helpers.ts","../src/permissions/scopes-bulder.ts"],"sourcesContent":["export type ActionScopesArray = (string | string[])[];\n\n/**\n * Action scopes are used to describe\n * what scopes are required to execute an action.\n */\nexport class ActionScopes {\n  public array: ActionScopesArray = [];\n  public anyScope = false;\n  private idsMap = new Map<string, string>();\n\n  constructor(scopes?: ActionScopesArray) {\n    if (scopes) {\n      this.array = scopes ?? [];\n    }\n  }\n\n  /**\n   * Set id scope (e.g. 'id#jsu:123')\n   * @param id - entity id\n   * @returns - this\n   * @example\n   * scopes.setEntityId('jsu:123')\n   *\n   * // scopes.getArray() = ['id#jsu:123']\n   */\n  setEntityId(id: string): this {\n    this.set(`id#${id}`);\n\n    return this;\n  }\n\n  /**\n   * Set scope (e.g. 'org', 'org+review')\n   * @param scope - scope name (e.g. 'org', 'org+review')\n   * @param id - entity id (e.g. 'jsorg:hci')\n   * @returns - this\n   * @example\n   * scopes.set('my')\n   *\n   * // scopes.getArray() = ['my']\n   *\n   * scopes.set('org', 'jsorg:hci')\n   *\n   * // scopes.getArray() = ['org#jsorg:hci']\n   */\n  set(scope: string, id?: string): this {\n    if (id && /^[A-Za-z_]+$/.test(scope)) {\n      this.idsMap.set(scope, id);\n    }\n\n    if (scope.includes('+')) {\n      const subscopes = scope.split('+');\n      this.array.push(\n        subscopes.map((subscope) => this.resolveScopeId(subscope)),\n      );\n    } else {\n      this.array.push(this.resolveScopeId(scope));\n    }\n\n    return this;\n  }\n\n  has(scope: string): boolean {\n    return this.array.includes(scope);\n  }\n\n  getArray(): ActionScopesArray {\n    return [...this.array];\n  }\n\n  /**\n   * Permission scopes must cover auth scopes determined in auth context.\n   * @param permissionScopes\n   */\n  canBeExecutedInScopes(\n    permissionScopes: readonly (string | string[])[],\n  ): boolean {\n    // if scopes has * then it can be executed in any scope\n    if (this.array.includes('*')) {\n      return true;\n    }\n\n    /* action scopes = ['user#jsu:123', 'org#hci', ['org#hci', 'draft']]\n    /* permission scopes: ['user#jsu:123', ['org#hci', 'draft']]\n\n    /**\n     * empty user permission scopes = full access to action\n     */\n    if (permissionScopes.length === 0) {\n      return true;\n    }\n\n    /**\n     * Empty auth scopes but user has permission scopes = no access to action\n     *\n     * action scopes = []\n     * permission scopes = ['org#hci']\n     *\n     * Example:\n     * User try to get list of all entities\n     * But user only has permission to entity from org#hci\n     */\n    if (this.array.length === 0) {\n      return false;\n    }\n\n    return this.array.some((authScope) => {\n      if (Array.isArray(authScope)) {\n        // scopes ['org#hci', 'draft'] == permissionScope ['org#hci', 'draft']\n\n        return permissionScopes.some((permissionScope) => {\n          if (Array.isArray(permissionScope)) {\n            return permissionScope.every(\n              (sub) => authScope.includes(sub),\n            );\n          }\n\n          return authScope.includes(permissionScope);\n        });\n      }\n\n      return permissionScopes.includes(authScope); // 'user#jsu:123' == 'user#jsu:123'\n    });\n  }\n\n  /**\n   * Resolve presaved scopes\n   * @example\n   * authCtx.setScope('org', 'jsorg:hci')\n   * [org#hci]\n   *\n   * authCtx.setScope('org+review');\n   * [org#hci, [org#hci, review]]\n   **/\n  private resolveScopeId(scope: string) {\n    return this.idsMap.has(scope)\n      ? `${scope}#${this.idsMap.get(scope)}`\n      : scope;\n  }\n}\n","import {\n  ReadonlyResolvedPermission, ResolvedPermission, ResolvedPermissionGroup,\n} from '../types/permissions.js';\nimport { IUser } from '../types/user.js';\nimport { ActionScopes, ActionScopesArray } from './action-scopes.js';\n\n/**\n * Normilize scopes to ActionScopes\n * @example\n * const scopes = normalizeScopes(['org#hci', 'user#hcu:xxxxx') // ActionScopes\n *\n * scopes.set('my')\n */\nconst normalizeScopes = (\n  scopes: ActionScopesArray | ActionScopes,\n): ActionScopes => {\n  if (!(scopes instanceof ActionScopes)) {\n    return new ActionScopes(scopes);\n  }\n\n  return scopes as ActionScopes;\n};\n\n/**\n * Check if user has access to permission\n * @example\n *\n * // Check episode access\n * const scopes = new ActionScopes();\n * scopes.setEntityId(episode.id); // id#js:core:episodes:xxxxx\n * scopes.set('org', episode.organizationId); // org#hcorg:hci\n *\n * isGranted(user, 'js:core:episodes:get', scopes)\n * @param user - user object with resolvedPermissions\n * @param permission - permission string (e.g. 'js:core:episodes:get')\n * @param actionScopes - action scopes (e.g. ['org#hcorg:hci'] or ActionScopes instance)\n * @returns - true if user has access to permission\n */\nexport const isGranted = (\n  user: IUser,\n  permission: string,\n  actionScopes: ActionScopesArray | ActionScopes = [],\n): boolean => {\n  const [service, module, resource, action] = permission.split(':');\n\n  if (!user?.resolvedPermissions || user.resolvedPermissions.length === 0) {\n    return false;\n  }\n\n  const userPermissions = user.resolvedPermissions;\n\n  const scopes = normalizeScopes(actionScopes);\n\n  const permissionCanBeExecutedInScopes = (perm: ReadonlyResolvedPermission, scopes: ActionScopes) =>\n    (!perm.scopes || perm.scopes.length === 0 || scopes.canBeExecutedInScopes(perm.scopes));\n\n  const regexp = new RegExp(`^(${service}|\\\\*):(${module}|\\\\*):(${resource}|\\\\*):(${action}|\\\\*)$`);\n\n  // novajs:*:*:* or novajs:*:*[org]:*\n  // novajs:module:*:* or novajs:module:*[org]:*\n  // novajs:module:resource:* or novajs:module:resource:[org]:*\n  // novajs:modules:resource:create\n  // *:modules:resource:create\n  if (userPermissions.some(\n    (perm) => regexp.test(perm.id) &&\n    permissionCanBeExecutedInScopes(perm, scopes))\n  ) {\n    return true;\n  }\n\n  return false;\n};\n\nexport const encodeScopes = (scopes: (string | string[])[]): string => {\n  const scopesString = scopes\n    .map((s) => (Array.isArray(s) ? s.join('+') : s))\n    .join(',');\n\n  return scopesString.length > 0 ? `[${scopesString}]` : '';\n};\n\n/**\n * Inject scopes into permission\n * @param permission - permission string (e.g. 'js:core:episodes:get')\n * @param scopesToInject - scopes to inject (e.g. ['org', 'published'])\n * @returns - permission string with injected scopes (e.g. 'js:core:episodes[org,published]:get')\n * @example\n * injectScopesIntoPermission('js:core:episodes:get', ['org', 'published'])\n * // js:core:episodes[org,published]:get\n */\nexport const injectScopesIntoPermission = (\n  permission: string,\n  scopesToInject: (string | string[])[],\n) => {\n  const { id, scopes = [] } = resolvePermission(permission);\n\n  const [service, module, resource, action] = id.split(':');\n\n  concatScopes(scopes, scopesToInject);\n\n  return `${service}:${module}:${resource}${encodeScopes(scopes)}:${action}`;\n};\n\n/**\n * Concat scopes\n * @param set - set of scopes\n * @param items - items to concat\n * @example\n * concatScopes(['org#hci'], ['org#dv'])\n * // ['org#hci', 'org#dv']\n */\nexport const concatScopes = (\n  set: (string | string[])[],\n  items: (string | string[])[],\n): void => {\n  for (const item of items) {\n    if (Array.isArray(item)) {\n      // check if scopes not includes array with subscopes rp2Scope\n      if (\n        !set.some(\n          (scope) =>\n            Array.isArray(scope) &&\n            scope.length === item.length &&\n            scope.every((s) => item.includes(s)),\n        )\n      ) {\n        set.push(item);\n      }\n    } else if (!set.includes(item)) {\n      set.push(item);\n    }\n  }\n};\n\n/**\n * Resolve permission string to object with scopes\n * @param permission - permission string\n * @returns - resolved permission object\n * @example\n * resolvePermission('js:core:episodes[org,published]:get')\n * // { id: 'js:core:episodes:get', scopes: ['org', 'published'] }\n */\nexport const resolvePermission = (permission: string): ResolvedPermission => {\n  const matches = /\\[(?<scopes>.*?)\\]/u.exec(permission);\n\n  if (matches?.[0] && matches.groups?.scopes) {\n    const scopes: (string | string[])[] = String(matches.groups.scopes)\n      .split(',') // scopes with OR logic\n      .map((s) => {\n        if (s.includes('+')) {\n          return s.split('+'); // scopes with AND logic\n        }\n\n        return s;\n      });\n\n    return {\n      id: permission.replace(matches[0], ''),\n      scopes,\n    };\n  }\n\n  return {\n    id: permission,\n    scopes: [],\n  };\n};\n\n/**\n * Resolve permissions to array of resolved permissions\n * @param permissions - array of permissions\n * @returns - array of resolved permissions\n * @example\n * resolvePermissions(['js:core:episodes[org]:get', 'js:core:episodes[published]:get'])\n * // [{ id: 'js:core:episodes:get', scopes: ['org', 'published'] }]\n */\nexport const resolvePermissions = (\n  permissions: string[],\n): ResolvedPermission[] => {\n  const resolvedPermissions: ResolvedPermission[] = [];\n\n  for (const permission of permissions) {\n    const { id, scopes } = resolvePermission(permission);\n\n    const currentPermission = resolvedPermissions.find(\n      (p) => p.id === id,\n    );\n\n    if (currentPermission) {\n      concatScopes(currentPermission.scopes, scopes);\n    } else {\n      resolvedPermissions.push({\n        id,\n        scopes,\n      });\n    }\n  }\n\n  return resolvedPermissions;\n};\n\n/**\n * Resolve permission group string to object with scopes\n * @param permissionGroup - permission group string\n * @returns - resolved permission group object\n * @example\n * resolvePermissionGroup('g:js:core:episodes[org]:read')\n * // { id: 'g:js:core:episodes:read', scopes: ['org'] }\n */\nexport const resolvePermissionGroup = (permissionGroup: string) => {\n  // Currently it has the same algorithm\n  return resolvePermission(permissionGroup);\n};\n\n/**\n * Resolve permission groups to array of resolved permission groups\n * @param permissionGroups - array of permission groups\n * @returns - array of resolved permission groups\n * @example\n * resolvePermissionGroups(['g:js:core:episodes[org]:read', 'g:js:core:episodes[published]:read'])\n * // [{ id: 'g:js:core:episodes:read', scopes: ['org', 'published'] }]\n */\nexport const resolvePermissionGroups = (\n  permissionGroups: string[],\n): ResolvedPermissionGroup[] => {\n  // Currently it has the same algorithm\n  return resolvePermissions(permissionGroups);\n};\n\nexport const mergeResolvedPermissions = (\n  array1: ResolvedPermission[],\n  array2: ResolvedPermission[],\n) => {\n  const result: ResolvedPermission[] = [];\n\n  for (const rp1 of array1) {\n    const rps2 = array2.filter((rp2) => rp2.id === rp1.id);\n\n    /* Empty scopes = has full access */\n    if (\n      rp1.scopes.length === 0 ||\n      rps2.some((rp2) => rp2.id === rp1.id && rp2.scopes.length === 0)\n    ) {\n      result.push({\n        id: rp1.id,\n        scopes: [],\n      });\n\n      continue;\n    }\n\n    // [org#hci, user#hcu:xxxxx, [org#hci, review]]\n    const scopes = [...rp1.scopes];\n    for (const rp2 of rps2) {\n      concatScopes(scopes, rp2.scopes);\n    }\n\n    result.push({\n      id: rp1.id,\n      scopes,\n    });\n  }\n\n  for (const rp2 of array2) {\n    if (!result.some((rp) => rp.id === rp2.id)) {\n      result.push(rp2);\n    }\n  }\n\n  return result;\n};\n\n/**\n * Replace scope in array of scopes\n * @param scopes - array of scopes\n * @param from - scope to replace\n * @param to - scope to replace with\n * @returns  - array of scopes with replaced scopes\n * @example\n * replaceScope(['org#jsorg:xxx', ['org#jsorg:xxx', 'published']], 'org#jsorg:xxx', 'org#jsorg:hci')\n * // ['org#jsorg:hci', ['org#jsorg:hci', 'published']]\n */\nexport const replaceScope = (\n  scopes: (string | string[])[], // [org#jsorg:xxx, [org#jsorg:xxx, published]]\n  from: string,\n  to: string | (string | string[])[],\n) => {\n  const result: (string | string[])[] = [];\n  for (const scope of scopes) {\n    if (Array.isArray(scope)) {\n      result.push(replaceScope(scope, from, to) as string[]);\n    } else if (scope === from) {\n      if (Array.isArray(to)) {\n        result.push(...to);\n      } else {\n        result.push(to);\n      }\n    } else {\n      result.push(scope);\n    }\n  }\n\n  return result;\n};\n","import { concatScopes } from './helpers.js';\n\nexport class ScopesBulder {\n  constructor(private scopes: (string | string[])[] = []) {}\n\n  static fromBulder(builder: ScopesBulder) {\n    return new ScopesBulder(builder.scopes.slice());\n  }\n\n  build() {\n    return JSON.parse(JSON.stringify(this.scopes)) as (string | string[])[];\n  }\n\n  clone() {\n    return ScopesBulder.fromBulder(this);\n  }\n\n  /**\n   * Append scope or scopes to the current scopes\n   * @param scope - scope or array of scopes to append\n   * @example\n   * append('org#jsorg:hci')\n   * // ['org#xxx'] => ['org#xxx', 'org#jsorg:hci']\n   * append(['org#hci', 'lang#en])\n   * // ['org#xxx'] => ['org#xxx', ['org#hci', 'lang#en']]\n   */\n  append(scope: string | string[]) {\n    this.scopes.push(scope);\n  }\n\n  /**\n   * Extend current scopes with the given scopes\n   * @param scopes - scope or array of scopes to extend with\n   * @example\n   * extend(['lang#en', 'lang#de'])\n   * // ['published', 'draft'] => ['published', 'draft', 'lang#en', 'lang#de']\n   */\n  extend(scopes: (string | string[])[] | ScopesBulder) {\n    if (Array.isArray(scopes)) {\n      concatScopes(this.scopes, scopes);\n    } else if (scopes instanceof ScopesBulder) {\n      concatScopes(this.scopes, scopes.scopes);\n    }\n  }\n\n  /**\n   * Join all scopes with the given scope\n   * @param scope - scope to join with\n   * @example\n   * join('org#jsorg:hci', 'before')\n   * // ['published', 'draft'] => [['org#jsorg:hci', 'published'], ['org#jsorg:hci', 'draft']]\n   * join(['lang#en', 'lang#de'])\n   * // ['published', 'draft'] => [['published', 'lang#en'], ['published', 'lang#de'], ['draft', 'lang#en'], ['draft', 'lang#de']]\n   */\n  join(scopeOrScopes: string | (string | string[])[], pos: 'before' | 'after' = 'after') {\n    const result: (string | string[])[] = [];\n\n    const scopesToJoin = Array.isArray(scopeOrScopes) ? scopeOrScopes : [scopeOrScopes];\n\n    if (scopesToJoin.length === 0) {\n      return;\n    }\n\n    const currentScopesCopy = this.build();\n    for (const scope of scopesToJoin) {\n      const scopeToJoin = Array.isArray(scope) ? scope : [scope];\n\n      for (const s of currentScopesCopy) {\n        if (Array.isArray(s)) {\n          result.push(pos === 'before' ? [...scopeToJoin, ...s] : [...s, ...scopeToJoin]);\n        } else {\n          result.push(pos === 'before' ? [...scopeToJoin, s] : [s, ...scopeToJoin]);\n        }\n      }\n    }\n\n    this.scopes = result;\n  }\n\n  /**\n   * Replace prefix in all scopes\n   * @param from - prefix to replace\n   * @param to - prefix to replace with\n   * @example\n   * replacePrefix('org', 'id')\n   * ['org#jsorg:hci'] => ['id#jsorg:hci']\n   */\n  replacePrefix(from: string, to: string) {\n    const result: (string | string[])[] = [];\n    for (const scope of this.scopes) {\n      if (Array.isArray(scope)) {\n        result.push(scope.map((s) => s.replace(`${from}#`, `${to}#`)));\n      } else {\n        result.push(scope.replace(`${from}#`, `${to}#`));\n      }\n    }\n    this.scopes = result;\n  }\n}\n"],"mappings":";;;;;AAMA,IAAa,eAAb,MAA0B;CACxB,AAAO,QAA2B,EAAE;CACpC,AAAO,WAAW;CAClB,AAAQ,yBAAS,IAAI,KAAqB;CAE1C,YAAY,QAA4B;AACtC,MAAI,OACF,MAAK,QAAQ,UAAU,EAAE;;;;;;;;;;;CAa7B,YAAY,IAAkB;AAC5B,OAAK,IAAI,MAAM,KAAK;AAEpB,SAAO;;;;;;;;;;;;;;;;CAiBT,IAAI,OAAe,IAAmB;AACpC,MAAI,MAAM,eAAe,KAAK,MAAM,CAClC,MAAK,OAAO,IAAI,OAAO,GAAG;AAG5B,MAAI,MAAM,SAAS,IAAI,EAAE;GACvB,MAAM,YAAY,MAAM,MAAM,IAAI;AAClC,QAAK,MAAM,KACT,UAAU,KAAK,aAAa,KAAK,eAAe,SAAS,CAAC,CAC3D;QAED,MAAK,MAAM,KAAK,KAAK,eAAe,MAAM,CAAC;AAG7C,SAAO;;CAGT,IAAI,OAAwB;AAC1B,SAAO,KAAK,MAAM,SAAS,MAAM;;CAGnC,WAA8B;AAC5B,SAAO,CAAC,GAAG,KAAK,MAAM;;;;;;CAOxB,sBACE,kBACS;AAET,MAAI,KAAK,MAAM,SAAS,IAAI,CAC1B,QAAO;AAST,MAAI,iBAAiB,WAAW,EAC9B,QAAO;;;;;;;;;;;AAaT,MAAI,KAAK,MAAM,WAAW,EACxB,QAAO;AAGT,SAAO,KAAK,MAAM,MAAM,cAAc;AACpC,OAAI,MAAM,QAAQ,UAAU,CAG1B,QAAO,iBAAiB,MAAM,oBAAoB;AAChD,QAAI,MAAM,QAAQ,gBAAgB,CAChC,QAAO,gBAAgB,OACpB,QAAQ,UAAU,SAAS,IAAI,CACjC;AAGH,WAAO,UAAU,SAAS,gBAAgB;KAC1C;AAGJ,UAAO,iBAAiB,SAAS,UAAU;IAC3C;;;;;;;;;;;CAYJ,AAAQ,eAAe,OAAe;AACpC,SAAO,KAAK,OAAO,IAAI,MAAM,GACzB,GAAG,MAAM,GAAG,KAAK,OAAO,IAAI,MAAM,KAClC;;;;;;;;;;;;;AC7HR,MAAM,mBACJ,WACiB;AACjB,KAAI,EAAE,kBAAkB,cACtB,QAAO,IAAI,aAAa,OAAO;AAGjC,QAAO;;;;;;;;;;;;;;;;;AAkBT,MAAa,aACX,MACA,YACA,eAAiD,EAAE,KACvC;CACZ,MAAM,CAAC,SAAS,QAAQ,UAAU,UAAU,WAAW,MAAM,IAAI;AAEjE,KAAI,CAAC,MAAM,uBAAuB,KAAK,oBAAoB,WAAW,EACpE,QAAO;CAGT,MAAM,kBAAkB,KAAK;CAE7B,MAAM,SAAS,gBAAgB,aAAa;CAE5C,MAAM,mCAAmC,MAAkC,aACxE,CAAC,KAAK,UAAU,KAAK,OAAO,WAAW,KAAKA,SAAO,sBAAsB,KAAK,OAAO;CAExF,MAAM,yBAAS,IAAI,OAAO,KAAK,QAAQ,SAAS,OAAO,SAAS,SAAS,SAAS,OAAO,QAAQ;AAOjG,KAAI,gBAAgB,MACjB,SAAS,OAAO,KAAK,KAAK,GAAG,IAC9B,gCAAgC,MAAM,OAAO,CAAC,CAE9C,QAAO;AAGT,QAAO;;AAGT,MAAa,gBAAgB,WAA0C;CACrE,MAAM,eAAe,OAClB,KAAK,MAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,EAAG,CAChD,KAAK,IAAI;AAEZ,QAAO,aAAa,SAAS,IAAI,IAAI,aAAa,KAAK;;;;;;;;;;;AAYzD,MAAa,8BACX,YACA,mBACG;CACH,MAAM,EAAE,IAAI,SAAS,EAAE,KAAK,kBAAkB,WAAW;CAEzD,MAAM,CAAC,SAAS,QAAQ,UAAU,UAAU,GAAG,MAAM,IAAI;AAEzD,cAAa,QAAQ,eAAe;AAEpC,QAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,aAAa,OAAO,CAAC,GAAG;;;;;;;;;;AAWpE,MAAa,gBACX,KACA,UACS;AACT,MAAK,MAAM,QAAQ,MACjB,KAAI,MAAM,QAAQ,KAAK,EAErB;MACE,CAAC,IAAI,MACF,UACC,MAAM,QAAQ,MAAM,IACpB,MAAM,WAAW,KAAK,UACtB,MAAM,OAAO,MAAM,KAAK,SAAS,EAAE,CAAC,CACvC,CAED,KAAI,KAAK,KAAK;YAEP,CAAC,IAAI,SAAS,KAAK,CAC5B,KAAI,KAAK,KAAK;;;;;;;;;;AAapB,MAAa,qBAAqB,eAA2C;CAC3E,MAAM,UAAU,sBAAsB,KAAK,WAAW;AAEtD,KAAI,UAAU,MAAM,QAAQ,QAAQ,QAAQ;EAC1C,MAAMC,SAAgC,OAAO,QAAQ,OAAO,OAAO,CAChE,MAAM,IAAI,CACV,KAAK,MAAM;AACV,OAAI,EAAE,SAAS,IAAI,CACjB,QAAO,EAAE,MAAM,IAAI;AAGrB,UAAO;IACP;AAEJ,SAAO;GACL,IAAI,WAAW,QAAQ,QAAQ,IAAI,GAAG;GACtC;GACD;;AAGH,QAAO;EACL,IAAI;EACJ,QAAQ,EAAE;EACX;;;;;;;;;;AAWH,MAAa,sBACX,gBACyB;CACzB,MAAMC,sBAA4C,EAAE;AAEpD,MAAK,MAAM,cAAc,aAAa;EACpC,MAAM,EAAE,IAAI,WAAW,kBAAkB,WAAW;EAEpD,MAAM,oBAAoB,oBAAoB,MAC3C,MAAM,EAAE,OAAO,GACjB;AAED,MAAI,kBACF,cAAa,kBAAkB,QAAQ,OAAO;MAE9C,qBAAoB,KAAK;GACvB;GACA;GACD,CAAC;;AAIN,QAAO;;;;;;;;;;AAWT,MAAa,0BAA0B,oBAA4B;AAEjE,QAAO,kBAAkB,gBAAgB;;;;;;;;;;AAW3C,MAAa,2BACX,qBAC8B;AAE9B,QAAO,mBAAmB,iBAAiB;;AAG7C,MAAa,4BACX,QACA,WACG;CACH,MAAMC,SAA+B,EAAE;AAEvC,MAAK,MAAM,OAAO,QAAQ;EACxB,MAAM,OAAO,OAAO,QAAQ,QAAQ,IAAI,OAAO,IAAI,GAAG;AAGtD,MACE,IAAI,OAAO,WAAW,KACtB,KAAK,MAAM,QAAQ,IAAI,OAAO,IAAI,MAAM,IAAI,OAAO,WAAW,EAAE,EAChE;AACA,UAAO,KAAK;IACV,IAAI,IAAI;IACR,QAAQ,EAAE;IACX,CAAC;AAEF;;EAIF,MAAM,SAAS,CAAC,GAAG,IAAI,OAAO;AAC9B,OAAK,MAAM,OAAO,KAChB,cAAa,QAAQ,IAAI,OAAO;AAGlC,SAAO,KAAK;GACV,IAAI,IAAI;GACR;GACD,CAAC;;AAGJ,MAAK,MAAM,OAAO,OAChB,KAAI,CAAC,OAAO,MAAM,OAAO,GAAG,OAAO,IAAI,GAAG,CACxC,QAAO,KAAK,IAAI;AAIpB,QAAO;;;;;;;;;;;;AAaT,MAAa,gBACX,QACA,MACA,OACG;CACH,MAAMC,SAAgC,EAAE;AACxC,MAAK,MAAM,SAAS,OAClB,KAAI,MAAM,QAAQ,MAAM,CACtB,QAAO,KAAK,aAAa,OAAO,MAAM,GAAG,CAAa;UAC7C,UAAU,KACnB,KAAI,MAAM,QAAQ,GAAG,CACnB,QAAO,KAAK,GAAG,GAAG;KAElB,QAAO,KAAK,GAAG;KAGjB,QAAO,KAAK,MAAM;AAItB,QAAO;;;;;AC5ST,IAAa,eAAb,MAAa,aAAa;CACxB,YAAY,AAAQC,SAAgC,EAAE,EAAE;EAApC;;CAEpB,OAAO,WAAW,SAAuB;AACvC,SAAO,IAAI,aAAa,QAAQ,OAAO,OAAO,CAAC;;CAGjD,QAAQ;AACN,SAAO,KAAK,MAAM,KAAK,UAAU,KAAK,OAAO,CAAC;;CAGhD,QAAQ;AACN,SAAO,aAAa,WAAW,KAAK;;;;;;;;;;;CAYtC,OAAO,OAA0B;AAC/B,OAAK,OAAO,KAAK,MAAM;;;;;;;;;CAUzB,OAAO,QAA8C;AACnD,MAAI,MAAM,QAAQ,OAAO,CACvB,cAAa,KAAK,QAAQ,OAAO;WACxB,kBAAkB,aAC3B,cAAa,KAAK,QAAQ,OAAO,OAAO;;;;;;;;;;;CAa5C,KAAK,eAA+C,MAA0B,SAAS;EACrF,MAAMC,SAAgC,EAAE;EAExC,MAAM,eAAe,MAAM,QAAQ,cAAc,GAAG,gBAAgB,CAAC,cAAc;AAEnF,MAAI,aAAa,WAAW,EAC1B;EAGF,MAAM,oBAAoB,KAAK,OAAO;AACtC,OAAK,MAAM,SAAS,cAAc;GAChC,MAAM,cAAc,MAAM,QAAQ,MAAM,GAAG,QAAQ,CAAC,MAAM;AAE1D,QAAK,MAAM,KAAK,kBACd,KAAI,MAAM,QAAQ,EAAE,CAClB,QAAO,KAAK,QAAQ,WAAW,CAAC,GAAG,aAAa,GAAG,EAAE,GAAG,CAAC,GAAG,GAAG,GAAG,YAAY,CAAC;OAE/E,QAAO,KAAK,QAAQ,WAAW,CAAC,GAAG,aAAa,EAAE,GAAG,CAAC,GAAG,GAAG,YAAY,CAAC;;AAK/E,OAAK,SAAS;;;;;;;;;;CAWhB,cAAc,MAAc,IAAY;EACtC,MAAMA,SAAgC,EAAE;AACxC,OAAK,MAAM,SAAS,KAAK,OACvB,KAAI,MAAM,QAAQ,MAAM,CACtB,QAAO,KAAK,MAAM,KAAK,MAAM,EAAE,QAAQ,GAAG,KAAK,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC;MAE9D,QAAO,KAAK,MAAM,QAAQ,GAAG,KAAK,IAAI,GAAG,GAAG,GAAG,CAAC;AAGpD,OAAK,SAAS"}

package/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@pcg/auth",
+  "version": "1.0.0-alpha.0",
+  "description": "Authorization library",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "devDependencies": {
+    "@vitest/ui": "^4.0.8",
+    "vitest": "^4.0.8"
+  },
+  "scripts": {
+    "dev": "tsdown --watch",
+    "build": "tsdown",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "lint": "eslint \"src/**/*.ts\""
+  }
+}

package/src/index.ts

@@ -0,0 +1,4 @@
+export * from './permissions/index.js';
+export * from './types/permissions.js';
+export * from './types/user.js';
+

package/src/permissions/action-scopes.ts

@@ -0,0 +1,141 @@
+export type ActionScopesArray = (string | string[])[];
+
+/**
+ * Action scopes are used to describe
+ * what scopes are required to execute an action.
+ */
+export class ActionScopes {
+  public array: ActionScopesArray = [];
+  public anyScope = false;
+  private idsMap = new Map<string, string>();
+
+  constructor(scopes?: ActionScopesArray) {
+    if (scopes) {
+      this.array = scopes ?? [];
+    }
+  }
+
+  /**
+   * Set id scope (e.g. 'id#jsu:123')
+   * @param id - entity id
+   * @returns - this
+   * @example
+   * scopes.setEntityId('jsu:123')
+   *
+   * // scopes.getArray() = ['id#jsu:123']
+   */
+  setEntityId(id: string): this {
+    this.set(`id#${id}`);
+
+    return this;
+  }
+
+  /**
+   * Set scope (e.g. 'org', 'org+review')
+   * @param scope - scope name (e.g. 'org', 'org+review')
+   * @param id - entity id (e.g. 'jsorg:hci')
+   * @returns - this
+   * @example
+   * scopes.set('my')
+   *
+   * // scopes.getArray() = ['my']
+   *
+   * scopes.set('org', 'jsorg:hci')
+   *
+   * // scopes.getArray() = ['org#jsorg:hci']
+   */
+  set(scope: string, id?: string): this {
+    if (id && /^[A-Za-z_]+$/.test(scope)) {
+      this.idsMap.set(scope, id);
+    }
+
+    if (scope.includes('+')) {
+      const subscopes = scope.split('+');
+      this.array.push(
+        subscopes.map((subscope) => this.resolveScopeId(subscope)),
+      );
+    } else {
+      this.array.push(this.resolveScopeId(scope));
+    }
+
+    return this;
+  }
+
+  has(scope: string): boolean {
+    return this.array.includes(scope);
+  }
+
+  getArray(): ActionScopesArray {
+    return [...this.array];
+  }
+
+  /**
+   * Permission scopes must cover auth scopes determined in auth context.
+   * @param permissionScopes
+   */
+  canBeExecutedInScopes(
+    permissionScopes: readonly (string | string[])[],
+  ): boolean {
+    // if scopes has * then it can be executed in any scope
+    if (this.array.includes('*')) {
+      return true;
+    }
+
+    /* action scopes = ['user#jsu:123', 'org#hci', ['org#hci', 'draft']]
+    /* permission scopes: ['user#jsu:123', ['org#hci', 'draft']]
+
+    /**
+     * empty user permission scopes = full access to action
+     */
+    if (permissionScopes.length === 0) {
+      return true;
+    }
+
+    /**
+     * Empty auth scopes but user has permission scopes = no access to action
+     *
+     * action scopes = []
+     * permission scopes = ['org#hci']
+     *
+     * Example:
+     * User try to get list of all entities
+     * But user only has permission to entity from org#hci
+     */
+    if (this.array.length === 0) {
+      return false;
+    }
+
+    return this.array.some((authScope) => {
+      if (Array.isArray(authScope)) {
+        // scopes ['org#hci', 'draft'] == permissionScope ['org#hci', 'draft']
+
+        return permissionScopes.some((permissionScope) => {
+          if (Array.isArray(permissionScope)) {
+            return permissionScope.every(
+              (sub) => authScope.includes(sub),
+            );
+          }
+
+          return authScope.includes(permissionScope);
+        });
+      }
+
+      return permissionScopes.includes(authScope); // 'user#jsu:123' == 'user#jsu:123'
+    });
+  }
+
+  /**
+   * Resolve presaved scopes
+   * @example
+   * authCtx.setScope('org', 'jsorg:hci')
+   * [org#hci]
+   *
+   * authCtx.setScope('org+review');
+   * [org#hci, [org#hci, review]]
+   **/
+  private resolveScopeId(scope: string) {
+    return this.idsMap.has(scope)
+      ? `${scope}#${this.idsMap.get(scope)}`
+      : scope;
+  }
+}

package/src/permissions/helpers.ts

@@ -0,0 +1,304 @@
+import {
+  ReadonlyResolvedPermission, ResolvedPermission, ResolvedPermissionGroup,
+} from '../types/permissions.js';
+import { IUser } from '../types/user.js';
+import { ActionScopes, ActionScopesArray } from './action-scopes.js';
+
+/**
+ * Normilize scopes to ActionScopes
+ * @example
+ * const scopes = normalizeScopes(['org#hci', 'user#hcu:xxxxx') // ActionScopes
+ *
+ * scopes.set('my')
+ */
+const normalizeScopes = (
+  scopes: ActionScopesArray | ActionScopes,
+): ActionScopes => {
+  if (!(scopes instanceof ActionScopes)) {
+    return new ActionScopes(scopes);
+  }
+
+  return scopes as ActionScopes;
+};
+
+/**
+ * Check if user has access to permission
+ * @example
+ *
+ * // Check episode access
+ * const scopes = new ActionScopes();
+ * scopes.setEntityId(episode.id); // id#js:core:episodes:xxxxx
+ * scopes.set('org', episode.organizationId); // org#hcorg:hci
+ *
+ * isGranted(user, 'js:core:episodes:get', scopes)
+ * @param user - user object with resolvedPermissions
+ * @param permission - permission string (e.g. 'js:core:episodes:get')
+ * @param actionScopes - action scopes (e.g. ['org#hcorg:hci'] or ActionScopes instance)
+ * @returns - true if user has access to permission
+ */
+export const isGranted = (
+  user: IUser,
+  permission: string,
+  actionScopes: ActionScopesArray | ActionScopes = [],
+): boolean => {
+  const [service, module, resource, action] = permission.split(':');
+
+  if (!user?.resolvedPermissions || user.resolvedPermissions.length === 0) {
+    return false;
+  }
+
+  const userPermissions = user.resolvedPermissions;
+
+  const scopes = normalizeScopes(actionScopes);
+
+  const permissionCanBeExecutedInScopes = (perm: ReadonlyResolvedPermission, scopes: ActionScopes) =>
+    (!perm.scopes || perm.scopes.length === 0 || scopes.canBeExecutedInScopes(perm.scopes));
+
+  const regexp = new RegExp(`^(${service}|\\*):(${module}|\\*):(${resource}|\\*):(${action}|\\*)$`);
+
+  // novajs:*:*:* or novajs:*:*[org]:*
+  // novajs:module:*:* or novajs:module:*[org]:*
+  // novajs:module:resource:* or novajs:module:resource:[org]:*
+  // novajs:modules:resource:create
+  // *:modules:resource:create
+  if (userPermissions.some(
+    (perm) => regexp.test(perm.id) &&
+    permissionCanBeExecutedInScopes(perm, scopes))
+  ) {
+    return true;
+  }
+
+  return false;
+};
+
+export const encodeScopes = (scopes: (string | string[])[]): string => {
+  const scopesString = scopes
+    .map((s) => (Array.isArray(s) ? s.join('+') : s))
+    .join(',');
+
+  return scopesString.length > 0 ? `[${scopesString}]` : '';
+};
+
+/**
+ * Inject scopes into permission
+ * @param permission - permission string (e.g. 'js:core:episodes:get')
+ * @param scopesToInject - scopes to inject (e.g. ['org', 'published'])
+ * @returns - permission string with injected scopes (e.g. 'js:core:episodes[org,published]:get')
+ * @example
+ * injectScopesIntoPermission('js:core:episodes:get', ['org', 'published'])
+ * // js:core:episodes[org,published]:get
+ */
+export const injectScopesIntoPermission = (
+  permission: string,
+  scopesToInject: (string | string[])[],
+) => {
+  const { id, scopes = [] } = resolvePermission(permission);
+
+  const [service, module, resource, action] = id.split(':');
+
+  concatScopes(scopes, scopesToInject);
+
+  return `${service}:${module}:${resource}${encodeScopes(scopes)}:${action}`;
+};
+
+/**
+ * Concat scopes
+ * @param set - set of scopes
+ * @param items - items to concat
+ * @example
+ * concatScopes(['org#hci'], ['org#dv'])
+ * // ['org#hci', 'org#dv']
+ */
+export const concatScopes = (
+  set: (string | string[])[],
+  items: (string | string[])[],
+): void => {
+  for (const item of items) {
+    if (Array.isArray(item)) {
+      // check if scopes not includes array with subscopes rp2Scope
+      if (
+        !set.some(
+          (scope) =>
+            Array.isArray(scope) &&
+            scope.length === item.length &&
+            scope.every((s) => item.includes(s)),
+        )
+      ) {
+        set.push(item);
+      }
+    } else if (!set.includes(item)) {
+      set.push(item);
+    }
+  }
+};
+
+/**
+ * Resolve permission string to object with scopes
+ * @param permission - permission string
+ * @returns - resolved permission object
+ * @example
+ * resolvePermission('js:core:episodes[org,published]:get')
+ * // { id: 'js:core:episodes:get', scopes: ['org', 'published'] }
+ */
+export const resolvePermission = (permission: string): ResolvedPermission => {
+  const matches = /\[(?<scopes>.*?)\]/u.exec(permission);
+
+  if (matches?.[0] && matches.groups?.scopes) {
+    const scopes: (string | string[])[] = String(matches.groups.scopes)
+      .split(',') // scopes with OR logic
+      .map((s) => {
+        if (s.includes('+')) {
+          return s.split('+'); // scopes with AND logic
+        }
+
+        return s;
+      });
+
+    return {
+      id: permission.replace(matches[0], ''),
+      scopes,
+    };
+  }
+
+  return {
+    id: permission,
+    scopes: [],
+  };
+};
+
+/**
+ * Resolve permissions to array of resolved permissions
+ * @param permissions - array of permissions
+ * @returns - array of resolved permissions
+ * @example
+ * resolvePermissions(['js:core:episodes[org]:get', 'js:core:episodes[published]:get'])
+ * // [{ id: 'js:core:episodes:get', scopes: ['org', 'published'] }]
+ */
+export const resolvePermissions = (
+  permissions: string[],
+): ResolvedPermission[] => {
+  const resolvedPermissions: ResolvedPermission[] = [];
+
+  for (const permission of permissions) {
+    const { id, scopes } = resolvePermission(permission);
+
+    const currentPermission = resolvedPermissions.find(
+      (p) => p.id === id,
+    );
+
+    if (currentPermission) {
+      concatScopes(currentPermission.scopes, scopes);
+    } else {
+      resolvedPermissions.push({
+        id,
+        scopes,
+      });
+    }
+  }
+
+  return resolvedPermissions;
+};
+
+/**
+ * Resolve permission group string to object with scopes
+ * @param permissionGroup - permission group string
+ * @returns - resolved permission group object
+ * @example
+ * resolvePermissionGroup('g:js:core:episodes[org]:read')
+ * // { id: 'g:js:core:episodes:read', scopes: ['org'] }
+ */
+export const resolvePermissionGroup = (permissionGroup: string) => {
+  // Currently it has the same algorithm
+  return resolvePermission(permissionGroup);
+};
+
+/**
+ * Resolve permission groups to array of resolved permission groups
+ * @param permissionGroups - array of permission groups
+ * @returns - array of resolved permission groups
+ * @example
+ * resolvePermissionGroups(['g:js:core:episodes[org]:read', 'g:js:core:episodes[published]:read'])
+ * // [{ id: 'g:js:core:episodes:read', scopes: ['org', 'published'] }]
+ */
+export const resolvePermissionGroups = (
+  permissionGroups: string[],
+): ResolvedPermissionGroup[] => {
+  // Currently it has the same algorithm
+  return resolvePermissions(permissionGroups);
+};
+
+export const mergeResolvedPermissions = (
+  array1: ResolvedPermission[],
+  array2: ResolvedPermission[],
+) => {
+  const result: ResolvedPermission[] = [];
+
+  for (const rp1 of array1) {
+    const rps2 = array2.filter((rp2) => rp2.id === rp1.id);
+
+    /* Empty scopes = has full access */
+    if (
+      rp1.scopes.length === 0 ||
+      rps2.some((rp2) => rp2.id === rp1.id && rp2.scopes.length === 0)
+    ) {
+      result.push({
+        id: rp1.id,
+        scopes: [],
+      });
+
+      continue;
+    }
+
+    // [org#hci, user#hcu:xxxxx, [org#hci, review]]
+    const scopes = [...rp1.scopes];
+    for (const rp2 of rps2) {
+      concatScopes(scopes, rp2.scopes);
+    }
+
+    result.push({
+      id: rp1.id,
+      scopes,
+    });
+  }
+
+  for (const rp2 of array2) {
+    if (!result.some((rp) => rp.id === rp2.id)) {
+      result.push(rp2);
+    }
+  }
+
+  return result;
+};
+
+/**
+ * Replace scope in array of scopes
+ * @param scopes - array of scopes
+ * @param from - scope to replace
+ * @param to - scope to replace with
+ * @returns  - array of scopes with replaced scopes
+ * @example
+ * replaceScope(['org#jsorg:xxx', ['org#jsorg:xxx', 'published']], 'org#jsorg:xxx', 'org#jsorg:hci')
+ * // ['org#jsorg:hci', ['org#jsorg:hci', 'published']]
+ */
+export const replaceScope = (
+  scopes: (string | string[])[], // [org#jsorg:xxx, [org#jsorg:xxx, published]]
+  from: string,
+  to: string | (string | string[])[],
+) => {
+  const result: (string | string[])[] = [];
+  for (const scope of scopes) {
+    if (Array.isArray(scope)) {
+      result.push(replaceScope(scope, from, to) as string[]);
+    } else if (scope === from) {
+      if (Array.isArray(to)) {
+        result.push(...to);
+      } else {
+        result.push(to);
+      }
+    } else {
+      result.push(scope);
+    }
+  }
+
+  return result;
+};

package/src/permissions/index.ts

@@ -0,0 +1,4 @@
+export * from './action-scopes.js';
+export * from './helpers.js';
+export * from './scopes-bulder.js';
+

package/src/permissions/scopes-bulder.ts

@@ -0,0 +1,99 @@
+import { concatScopes } from './helpers.js';
+
+export class ScopesBulder {
+  constructor(private scopes: (string | string[])[] = []) {}
+
+  static fromBulder(builder: ScopesBulder) {
+    return new ScopesBulder(builder.scopes.slice());
+  }
+
+  build() {
+    return JSON.parse(JSON.stringify(this.scopes)) as (string | string[])[];
+  }
+
+  clone() {
+    return ScopesBulder.fromBulder(this);
+  }
+
+  /**
+   * Append scope or scopes to the current scopes
+   * @param scope - scope or array of scopes to append
+   * @example
+   * append('org#jsorg:hci')
+   * // ['org#xxx'] => ['org#xxx', 'org#jsorg:hci']
+   * append(['org#hci', 'lang#en])
+   * // ['org#xxx'] => ['org#xxx', ['org#hci', 'lang#en']]
+   */
+  append(scope: string | string[]) {
+    this.scopes.push(scope);
+  }
+
+  /**
+   * Extend current scopes with the given scopes
+   * @param scopes - scope or array of scopes to extend with
+   * @example
+   * extend(['lang#en', 'lang#de'])
+   * // ['published', 'draft'] => ['published', 'draft', 'lang#en', 'lang#de']
+   */
+  extend(scopes: (string | string[])[] | ScopesBulder) {
+    if (Array.isArray(scopes)) {
+      concatScopes(this.scopes, scopes);
+    } else if (scopes instanceof ScopesBulder) {
+      concatScopes(this.scopes, scopes.scopes);
+    }
+  }
+
+  /**
+   * Join all scopes with the given scope
+   * @param scope - scope to join with
+   * @example
+   * join('org#jsorg:hci', 'before')
+   * // ['published', 'draft'] => [['org#jsorg:hci', 'published'], ['org#jsorg:hci', 'draft']]
+   * join(['lang#en', 'lang#de'])
+   * // ['published', 'draft'] => [['published', 'lang#en'], ['published', 'lang#de'], ['draft', 'lang#en'], ['draft', 'lang#de']]
+   */
+  join(scopeOrScopes: string | (string | string[])[], pos: 'before' | 'after' = 'after') {
+    const result: (string | string[])[] = [];
+
+    const scopesToJoin = Array.isArray(scopeOrScopes) ? scopeOrScopes : [scopeOrScopes];
+
+    if (scopesToJoin.length === 0) {
+      return;
+    }
+
+    const currentScopesCopy = this.build();
+    for (const scope of scopesToJoin) {
+      const scopeToJoin = Array.isArray(scope) ? scope : [scope];
+
+      for (const s of currentScopesCopy) {
+        if (Array.isArray(s)) {
+          result.push(pos === 'before' ? [...scopeToJoin, ...s] : [...s, ...scopeToJoin]);
+        } else {
+          result.push(pos === 'before' ? [...scopeToJoin, s] : [s, ...scopeToJoin]);
+        }
+      }
+    }
+
+    this.scopes = result;
+  }
+
+  /**
+   * Replace prefix in all scopes
+   * @param from - prefix to replace
+   * @param to - prefix to replace with
+   * @example
+   * replacePrefix('org', 'id')
+   * ['org#jsorg:hci'] => ['id#jsorg:hci']
+   */
+  replacePrefix(from: string, to: string) {
+    const result: (string | string[])[] = [];
+    for (const scope of this.scopes) {
+      if (Array.isArray(scope)) {
+        result.push(scope.map((s) => s.replace(`${from}#`, `${to}#`)));
+      } else {
+        result.push(scope.replace(`${from}#`, `${to}#`));
+      }
+    }
+    this.scopes = result;
+  }
+}

package/src/types/permissions.ts

@@ -0,0 +1,24 @@
+/**
+ * Resolved permission string to object with scopes
+ * @example
+ * 'js:core:episodes[org]:get' => { id: 'js:core:episodes:get', scopes: ['org'] }
+ */
+export interface ResolvedPermission {
+  id: string;
+  scopes: (string | string[])[];
+}
+
+/**
+ * Resolved permission string to object with scopes
+ * @example
+ * 'g:js:core:episodes[org]:read' => { id: 'g:js:core:episodes:read', scopes: ['org'] }
+ */
+export interface ResolvedPermissionGroup {
+  id: string;
+  scopes: (string | string[])[];
+}
+
+export interface ReadonlyResolvedPermission {
+  readonly id: string;
+  readonly scopes: readonly (string | string[])[];
+}

package/src/types/user.ts

@@ -0,0 +1,33 @@
+import { ReadonlyResolvedPermission } from './permissions.js';
+
+export interface IUser {
+  /**
+   * User ID
+   * @example
+   * ```ts
+   * 'hcu:2x6g7l8n9op'
+   * ```
+   */
+  id: string;
+
+  /**
+   * User's permissions
+   * @example
+   * ```ts
+   * ['js:core:episodes[org]:get', 'js:core:episodes[org]:create']
+   * ```
+   */
+  permissions: readonly string[];
+
+  /**
+   * User's resolved permissions
+   * @example
+   * ```ts
+   * [
+   *  { id: 'js:core:episodes:get', scopes: ['org'] },
+   *  { id: 'js:core:episodes:create', scopes: ['org'] },
+   * ]
+   * ```
+   */
+  resolvedPermissions: ReadonlyResolvedPermission[];
+}