@posiwise/common-services 0.2.6 → 0.2.8

package/fesm2022/posiwise-common-services.mjs

@@ -1452,6 +1452,9 @@ class PermissionService {
         if (!permission) {
             return false;
         }
+        if (typeof permission === 'boolean') {
+            return permission;
+        }
         let expr = '';
         if (permission === PERMISSION_NAMES.SuperAdmin) {
             return this.isSuperAdmin();
@@ -1479,22 +1482,23 @@ class PermissionService {
         // Now expr is made of true/false values with &&, ||, ()
         // Safe parser: no eval() - CSP 'unsafe-eval' not required
         const ourResult = this.evaluateBooleanExpression(expr);
-        let evalResult;
+        // Comparison: warn if result differs from legacy eval (for verification, no behavior change)
         try {
-            evalResult = eval(expr.trim());
+            // eslint-disable-next-line no-eval
+            const evalResult = eval(expr);
+            const evalAsBool = !!evalResult;
+            if (evalAsBool !== ourResult) {
+                console.warn('[PermissionService] Result diff vs eval:', {
+                    expr,
+                    ourResult,
+                    evalResult
+                });
+            }
         }
         catch {
-            evalResult = undefined;
-        }
-        if (ourResult !== evalResult) {
-            console.warn('[PermissionService] MISMATCH - parser vs eval', {
-                permission,
-                expr: expr.trim(),
-                ourResult,
-                evalResult
-            });
+            // eval blocked (CSP) or invalid - skip comparison
         }
-        return this.evaluateBooleanExpression(expr);
+        return ourResult;
     }
     /** Safe boolean expression parser - replaces eval() for CSP compliance. */
     evaluateBooleanExpression(expr) {
@@ -1531,17 +1535,23 @@ class PermissionService {
                 return (this.evaluateBooleanExpression(left) && this.evaluateBooleanExpression(right));
             }
         }
+        // Strip matching outer parens - only when first ( and last ) are a pair
         if (expr.startsWith('(') && expr.endsWith(')')) {
             let d = 0;
-            for (let j = 1; j < expr.length - 1; j++) {
+            for (let j = 0; j < expr.length; j++) {
                 if (expr[j] === '(')
                     d++;
-                if (expr[j] === ')')
+                else if (expr[j] === ')')
                     d--;
+                if (d === 0) {
+                    if (j === expr.length - 1) {
+                        return this.evaluateBooleanExpression(expr.substring(1, expr.length - 1));
+                    }
+                    break;
+                }
                 if (d < 0)
-                    return false;
+                    break;
             }
-            return this.evaluateBooleanExpression(expr.substring(1, expr.length - 1));
         }
         return false;
     }
@@ -1549,6 +1559,8 @@ class PermissionService {
         if (typeof permission !== 'boolean') {
             permission.split(' ').forEach(x => {
                 const raw = x.trim();
+                if (!raw)
+                    return;
                 if (['||', '&&', '(', ')'].includes(raw)) {
                     expr += ` ${raw} `;
                 }