@posiwise/common-services 0.1.97 → 0.1.99

package/fesm2022/posiwise-common-services.mjs

@@ -1489,8 +1489,10 @@ class PermissionService {
             return true;
         if (expr === 'false')
             return false;
+        // Recursively simplify: split on lowest-precedence operator at depth 0
+        // || has lower precedence than && in JS
         let depth = 0;
-        for (let i = 0; i < expr.length - 1; i++) {
+        for (let i = 0; i <= expr.length - 2; i++) {
             const c = expr[i];
             if (c === '(')
                 depth++;
@@ -1503,7 +1505,7 @@ class PermissionService {
             }
         }
         depth = 0;
-        for (let i = 0; i < expr.length - 1; i++) {
+        for (let i = 0; i <= expr.length - 2; i++) {
             const c = expr[i];
             if (c === '(')
                 depth++;
@@ -1515,6 +1517,7 @@ class PermissionService {
                 return (this.evaluateBooleanExpression(left) && this.evaluateBooleanExpression(right));
             }
         }
+        // Strip matching outer parens
         if (expr.startsWith('(') && expr.endsWith(')')) {
             let d = 0;
             for (let j = 1; j < expr.length - 1; j++) {
@@ -1527,12 +1530,15 @@ class PermissionService {
             }
             return this.evaluateBooleanExpression(expr.substring(1, expr.length - 1));
         }
+        // Unrecognized token - treat as false for safety
         return false;
     }
     handleNonBooleanPermissions(permission, expr, productKey, permission_key, productSlug) {
         if (typeof permission !== 'boolean') {
             permission.split(' ').forEach(x => {
                 const raw = x.trim();
+                if (!raw)
+                    return; // Skip empty tokens (e.g. from double spaces) - avoids malformed expr
                 if (['||', '&&', '(', ')'].includes(raw)) {
                     expr += ` ${raw} `;
                 }