@posiwise/common-services 0.1.92 → 0.1.93

package/fesm2022/posiwise-common-services.mjs

@@ -36,6 +36,16 @@ class ScriptLoaderService {
         this.document = document;
         this._scripts = {};
     }
+    getCspNonce() {
+        // Prefer explicit global set by server-side renderer
+        const w = globalThis;
+        if (w?.__cspNonce)
+            return w.__cspNonce;
+        // Fallback: try to read nonce from any existing script tag
+        const anyScript = this.document.querySelector('script[nonce]');
+        const n = anyScript?.nonce || anyScript?.getAttribute('nonce') || undefined;
+        return n || undefined;
+    }
     load(tag, ...scripts) {
         scripts.forEach((src) => {
             if (!this._scripts[src]) {
@@ -73,6 +83,9 @@ class ScriptLoaderService {
                 const scriptTag = document.createElement('script');
                 scriptTag.type = 'text/javascript';
                 scriptTag.src = this._scripts[src].src;
+                const nonce = this.getCspNonce();
+                if (nonce)
+                    scriptTag.nonce = nonce;
                 scriptTag.onload = () => {
                     this._scripts[src].loaded = true;
                     resolve({ src, loaded: true });
@@ -1353,7 +1366,7 @@ class PermissionService {
             // or Pages.Beta or Pages.Alpha
             if (permissionName?.includes('||')) {
                 const parts = permissionName.split('||').map(p => p.trim());
-                if (this.hasAnyGrantedPermission(parts, user)) {
+                if (this.hasAnyGrantedPermission(parts, user, productSlug)) {
                     return true;
                 }
             }
@@ -1370,8 +1383,12 @@ class PermissionService {
         // user not logged-in
         return false;
     }
-    hasAnyGrantedPermission(parts, user) {
-        return parts.some(part => user['auth']?.['granted'][part]);
+    hasAnyGrantedPermission(parts, user, productSlug = null) {
+        return parts.some(part => {
+            // Format the permission part with the current subscription slug if needed
+            const formattedPart = this.getFormattedPermissionName(part, productSlug);
+            return user['auth']?.['granted'][formattedPart];
+        });
     }
     handleProductKey(productKey, user, permission_key, permissionName) {
         if (productKey) {
@@ -1403,11 +1420,15 @@ class PermissionService {
         else {
             slugToCheck = productSlug;
         }
-        if (!permissionName.includes(slugToCheck) && permissionName.includes('Pages.Product.')) {
-            permissionName = permissionName.replace('Pages.Product.', slugToCheck);
-        }
-        if (permissionName.includes('Pages.Role.') && !permissionName.includes(slugToCheck)) {
-            permissionName = permissionName.replace('Pages.Role.', slugToCheck);
+        // Only format if we have a valid slug to check
+        if (slugToCheck) {
+            if (!permissionName.includes(slugToCheck) &&
+                permissionName.includes('Pages.Product.')) {
+                permissionName = permissionName.replace('Pages.Product.', slugToCheck);
+            }
+            if (permissionName.includes('Pages.Role.') && !permissionName.includes(slugToCheck)) {
+                permissionName = permissionName.replace('Pages.Role.', slugToCheck);
+            }
         }
         return permissionName;
     }
@@ -1492,7 +1513,8 @@ class PermissionService {
                         evaluated = this.isGranted(raw, productKey, permission_key, productSlug);
                     }
                     else {
-                        evaluated = this.isGranted(raw);
+                        // Pass productSlug to isGranted to ensure slug-aware permission checking
+                        evaluated = this.isGranted(raw, null, null, productSlug);
                     }
                     expr += ` ${evaluated} `;
                 }