@rhino-dev/rhino-nestjs 0.2.5

package/dist/services/validation.service.js

@@ -0,0 +1,203 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ValidationService = void 0;
+const common_1 = require("@nestjs/common");
+const zod_1 = require("zod");
+const permission_matcher_1 = require("../utils/permission-matcher");
+const prisma_service_1 = require("../prisma/prisma.service");
+const rhino_config_1 = require("../rhino.config");
+const fk_chain_walker_1 = require("../utils/fk-chain-walker");
+let ValidationService = class ValidationService {
+    prisma;
+    config;
+    constructor(prisma, config) {
+        this.prisma = prisma;
+        this.config = config;
+    }
+    /**
+     * Verify that every foreign-key in `data` references a record that lives
+     * inside the current organization (directly or through an FK chain). This
+     * implements Laravel's `scopeExistsRulesToOrganization` semantics for Prisma.
+     *
+     * Constraints are declared per model via:
+     *   ModelRegistration.fkConstraints?: Array<{ field: 'postId', model: 'post' }>
+     */
+    async verifyTenantFks(data, reg, organization) {
+        if (!organization || !this.prisma || !this.config)
+            return { valid: true };
+        const constraints = reg.fkConstraints ?? [];
+        if (constraints.length === 0)
+            return { valid: true };
+        const errors = {};
+        for (const c of constraints) {
+            const value = data[c.field];
+            if (value == null)
+                continue;
+            const ok = await this.isFkInOrg(c.model, value, organization);
+            if (!ok) {
+                errors[c.field] = [`referenced record not found in this organization`];
+            }
+        }
+        return Object.keys(errors).length === 0
+            ? { valid: true }
+            : { valid: false, errors };
+    }
+    async isFkInOrg(model, id, organization) {
+        const delegate = this.prisma.model(model);
+        // Fast path: model itself has organizationId
+        const record = await delegate.findFirst({
+            where: { id, organizationId: organization.id },
+        }).catch(() => null);
+        if (record)
+            return true;
+        // Otherwise walk FK chain based on registered models
+        const chain = (0, fk_chain_walker_1.findOrganizationFkChain)(model, {
+            getRelations: (m) => {
+                const reg = this.config.models();
+                for (const r of Object.values(reg)) {
+                    if (r.model === m && r.fkConstraints) {
+                        return r.fkConstraints.map((c) => ({
+                            localColumn: c.field,
+                            foreignModel: c.model,
+                            foreignColumn: 'id',
+                        }));
+                    }
+                }
+                return [];
+            },
+            hasOrganizationId: (m) => {
+                for (const r of Object.values(this.config.models())) {
+                    if (r.model === m && r.belongsToOrganization)
+                        return true;
+                }
+                return false;
+            },
+        });
+        if (!chain)
+            return false;
+        return this.walkFkChainForRecord(model, id, chain, organization);
+    }
+    async walkFkChainForRecord(startModel, id, chain, organization) {
+        let currentModel = startModel;
+        let currentId = id;
+        for (const step of chain) {
+            const delegate = this.prisma.model(currentModel);
+            const record = await delegate.findUnique({ where: { id: currentId } }).catch(() => null);
+            if (!record)
+                return false;
+            currentId = record[step.localColumn];
+            currentModel = step.foreignModel;
+            if (step.leadsToOrg) {
+                const parent = await this.prisma.model(currentModel).findFirst({
+                    where: { id: currentId, organizationId: organization.id },
+                }).catch(() => null);
+                return Boolean(parent);
+            }
+        }
+        return false;
+    }
+    validateForAction(data, reg, ctx) {
+        const input = { ...data };
+        // Strip framework-managed fields when inside a tenant context.
+        if (ctx.organization) {
+            delete input.organizationId;
+            delete input.organization_id;
+        }
+        // Resolve permitted fields from the policy.
+        const permittedFields = this.resolvePermittedFields(reg, ctx);
+        const allowAllFields = permittedFields.length === 1 && permittedFields[0] === '*';
+        // Reject forbidden fields explicitly.
+        if (!allowAllFields) {
+            const forbidden = Object.keys(input).filter((k) => !permittedFields.includes(k));
+            if (forbidden.length > 0) {
+                return {
+                    valid: false,
+                    forbiddenFields: forbidden,
+                    errors: { _forbidden: forbidden },
+                };
+            }
+        }
+        // Pick the right schema (store vs update, role-keyed vs direct).
+        let schema = this.pickSchema(reg, ctx);
+        if (!schema) {
+            // No schema → pass-through. Still removes forbidden fields above.
+            return { valid: true, data: input };
+        }
+        // If the schema is an object-shape and permittedFields restricts a subset,
+        // narrow down using pick() so unknown fields aren't required.
+        if (!allowAllFields && schema instanceof zod_1.ZodObject) {
+            const pickShape = Object.fromEntries(permittedFields.map((f) => [f, true]));
+            try {
+                schema = schema.pick(pickShape);
+            }
+            catch {
+                // ignore — keep full schema
+            }
+        }
+        const parsed = schema.safeParse(input);
+        if (!parsed.success) {
+            return { valid: false, errors: this.formatErrors(parsed.error) };
+        }
+        return { valid: true, data: parsed.data };
+    }
+    pickSchema(reg, ctx) {
+        const key = ctx.action;
+        const actionSchema = key === 'store' ? reg.validationStore : reg.validationUpdate;
+        if (actionSchema) {
+            if (actionSchema._def && typeof actionSchema.safeParse === 'function') {
+                return actionSchema;
+            }
+            // role-keyed
+            const roleKeyed = actionSchema;
+            const role = (0, permission_matcher_1.resolveUserRoleSlug)(ctx.user, ctx.organization?.id);
+            if (role && roleKeyed[role])
+                return roleKeyed[role];
+            if (roleKeyed['*'])
+                return roleKeyed['*'];
+        }
+        return reg.validation;
+    }
+    resolvePermittedFields(reg, ctx) {
+        if (!reg.policy)
+            return ['*'];
+        const policy = new reg.policy();
+        // BP-007 completion: pass organization so policy.hasRole(user, role, org)
+        // can resolve the active role (same reasoning as SerializerService —
+        // this path was missed in the original BP-007 fix).
+        if (ctx.action === 'store') {
+            return policy.permittedAttributesForCreate(ctx.user, ctx.organization) ?? ['*'];
+        }
+        return policy.permittedAttributesForUpdate(ctx.user, ctx.organization) ?? ['*'];
+    }
+    formatErrors(err) {
+        const out = {};
+        for (const issue of err.issues) {
+            const path = issue.path.join('.') || '_';
+            if (!out[path])
+                out[path] = [];
+            out[path].push(issue.message);
+        }
+        return out;
+    }
+};
+exports.ValidationService = ValidationService;
+exports.ValidationService = ValidationService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Optional)()),
+    __param(1, (0, common_1.Optional)()),
+    __metadata("design:paramtypes", [prisma_service_1.PrismaService,
+        rhino_config_1.RhinoConfigService])
+], ValidationService);
+//# sourceMappingURL=validation.service.js.map

package/dist/services/validation.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.service.js","sourceRoot":"","sources":["../../src/services/validation.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA8D;AAC9D,6BAA0D;AAE1D,oEAAkE;AAClE,6DAAyD;AACzD,kDAAqD;AACrD,8DAAgF;AA8BzE,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAEG;IACA;IAF/B,YAC+B,MAAsB,EACtB,MAA2B;QAD3B,WAAM,GAAN,MAAM,CAAgB;QACtB,WAAM,GAAN,MAAM,CAAqB;IACvD,CAAC;IAEJ;;;;;;;OAOG;IACH,KAAK,CAAC,eAAe,CACnB,IAAyB,EACzB,GAAsB,EACtB,YAAkB;QAElB,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC1E,MAAM,WAAW,GAAoB,GAAW,CAAC,aAAa,IAAI,EAAE,CAAC;QACrE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACrD,MAAM,MAAM,GAA6B,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,KAAK,IAAI,IAAI;gBAAE,SAAS;YAC5B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;YAC9D,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;YACrC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE;YACjB,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,EAAO,EAAE,YAAiB;QAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3C,6CAA6C;QAC7C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC;YACtC,KAAK,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,YAAY,CAAC,EAAE,EAAE;SAC/C,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,MAAM;YAAE,OAAO,IAAI,CAAC;QAExB,qDAAqD;QACrD,MAAM,KAAK,GAAG,IAAA,yCAAuB,EAAC,KAAK,EAAE;YAC3C,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE;gBAClB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAO,CAAC,MAAM,EAAE,CAAC;gBAClC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAK,CAAS,CAAC,aAAa,EAAE,CAAC;wBAC9C,OAAS,CAAS,CAAC,aAAgC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;4BAC9D,WAAW,EAAE,CAAC,CAAC,KAAK;4BACpB,YAAY,EAAE,CAAC,CAAC,KAAK;4BACrB,aAAa,EAAE,IAAI;yBACpB,CAAC,CAAC,CAAC;oBACN,CAAC;gBACH,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE;gBACvB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;oBACrD,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,qBAAqB;wBAAE,OAAO,IAAI,CAAC;gBAC5D,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,OAAO,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IACnE,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,UAAkB,EAClB,EAAO,EACP,KAAoB,EACpB,YAAiB;QAEjB,IAAI,YAAY,GAAG,UAAU,CAAC;QAC9B,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAC1B,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACrC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;YACjC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC;oBAC9D,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,CAAC,EAAE,EAAE;iBAC1D,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBACrB,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iBAAiB,CACf,IAAyB,EACzB,GAAsB,EACtB,GAAsB;QAEtB,MAAM,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QAE1B,+DAA+D;QAC/D,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,cAAc,CAAC;YAC5B,OAAO,KAAK,CAAC,eAAe,CAAC;QAC/B,CAAC;QAED,4CAA4C;QAC5C,MAAM,eAAe,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9D,MAAM,cAAc,GAAG,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;QAElF,sCAAsC;QACtC,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACjF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,eAAe,EAAE,SAAS;oBAC1B,MAAM,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;iBAClC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,iEAAiE;QACjE,IAAI,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,kEAAkE;YAClE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAU,EAAE,CAAC;QAC3C,CAAC;QAED,2EAA2E;QAC3E,8DAA8D;QAC9D,IAAI,CAAC,cAAc,IAAI,MAAM,YAAY,eAAS,EAAE,CAAC;YACnD,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5E,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAgB,CAAC,CAAC;YACzC,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;YAC9B,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAS,EAAE,CAAC;IACjD,CAAC;IAEO,UAAU,CAAC,GAAsB,EAAE,GAAsB;QAC/D,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;QACvB,MAAM,YAAY,GAAG,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAClF,IAAI,YAAY,EAAE,CAAC;YACjB,IAAK,YAAoB,CAAC,IAAI,IAAI,OAAQ,YAAoB,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;gBACxF,OAAO,YAAyB,CAAC;YACnC,CAAC;YACD,aAAa;YACb,MAAM,SAAS,GAAG,YAAyC,CAAC;YAC5D,MAAM,IAAI,GAAG,IAAA,wCAAmB,EAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YACjE,IAAI,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,SAAS,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,GAAG,CAAC,UAAU,CAAC;IACxB,CAAC;IAEO,sBAAsB,CAAC,GAAsB,EAAE,GAAsB;QAC3E,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAChC,0EAA0E;QAC1E,qEAAqE;QACrE,oDAAoD;QACpD,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,4BAA4B,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,MAAM,CAAC,4BAA4B,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClF,CAAC;IAEO,YAAY,CAAC,GAAe;QAClC,MAAM,GAAG,GAA6B,EAAE,CAAC;QACzC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAA;AAzLY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,iBAAQ,GAAE,CAAA;qCAD2B,8BAAa;QACb,iCAAkB;GAH/C,iBAAiB,CAyL7B"}