@posiwise/common-services 0.2.4 → 0.2.6

package/fesm2022/posiwise-common-services.mjs

@@ -1478,15 +1478,29 @@ class PermissionService {
         expr = this.handleNonBooleanPermissions(permission, expr, productKey, permission_key, productSlug);
         // Now expr is made of true/false values with &&, ||, ()
         // Safe parser: no eval() - CSP 'unsafe-eval' not required
+        const ourResult = this.evaluateBooleanExpression(expr);
+        let evalResult;
+        try {
+            evalResult = eval(expr.trim());
+        }
+        catch {
+            evalResult = undefined;
+        }
+        if (ourResult !== evalResult) {
+            console.warn('[PermissionService] MISMATCH - parser vs eval', {
+                permission,
+                expr: expr.trim(),
+                ourResult,
+                evalResult
+            });
+        }
         return this.evaluateBooleanExpression(expr);
     }
     /** Safe boolean expression parser - replaces eval() for CSP compliance. */
     evaluateBooleanExpression(expr) {
         expr = expr.replace(/\s+/g, ' ').trim();
-        if (!expr) {
-            console.warn('[evaluateBooleanExpression] empty expr', { expr: `"${expr}"` });
+        if (!expr)
             return false;
-        }
         if (expr === 'true')
             return true;
         if (expr === 'false')
@@ -1501,9 +1515,7 @@ class PermissionService {
             else if (depth === 0 && expr.substring(i, i + 2) === '||') {
                 const left = expr.substring(0, i).trim();
                 const right = expr.substring(i + 2).trim();
-                const result = this.evaluateBooleanExpression(left) || this.evaluateBooleanExpression(right);
-                console.debug('[evaluateBooleanExpression] ||', { expr, left, right, result });
-                return result;
+                return (this.evaluateBooleanExpression(left) || this.evaluateBooleanExpression(right));
             }
         }
         depth = 0;
@@ -1516,41 +1528,27 @@ class PermissionService {
             else if (depth === 0 && expr.substring(i, i + 2) === '&&') {
                 const left = expr.substring(0, i).trim();
                 const right = expr.substring(i + 2).trim();
-                const result = this.evaluateBooleanExpression(left) && this.evaluateBooleanExpression(right);
-                console.debug('[evaluateBooleanExpression] &&', { expr, left, right, result });
-                return result;
+                return (this.evaluateBooleanExpression(left) && this.evaluateBooleanExpression(right));
             }
         }
-        // Strip matching outer parens - only when first ( and last ) are a pair (fix for nested)
         if (expr.startsWith('(') && expr.endsWith(')')) {
             let d = 0;
-            for (let j = 0; j < expr.length; j++) {
+            for (let j = 1; j < expr.length - 1; j++) {
                 if (expr[j] === '(')
                     d++;
-                else if (expr[j] === ')')
+                if (expr[j] === ')')
                     d--;
-                if (d === 0) {
-                    if (j === expr.length - 1) {
-                        const inner = expr.substring(1, expr.length - 1);
-                        const result = this.evaluateBooleanExpression(inner);
-                        console.debug('[evaluateBooleanExpression] strip parens', { expr, inner, result });
-                        return result;
-                    }
-                    break;
-                }
                 if (d < 0)
-                    break;
+                    return false;
             }
+            return this.evaluateBooleanExpression(expr.substring(1, expr.length - 1));
         }
-        console.warn('[evaluateBooleanExpression] unrecognized', { expr });
         return false;
     }
     handleNonBooleanPermissions(permission, expr, productKey, permission_key, productSlug) {
         if (typeof permission !== 'boolean') {
             permission.split(' ').forEach(x => {
                 const raw = x.trim();
-                if (!raw)
-                    return;
                 if (['||', '&&', '(', ')'].includes(raw)) {
                     expr += ` ${raw} `;
                 }