@rytass/bpm-core-nestjs-module 0.4.0 → 0.5.0

package/src/lib/database/typeorm.config.ts

@@ -0,0 +1,217 @@
+import { TypeOrmModuleOptions } from '@nestjs/typeorm';
+import { VaultService } from '@rytass/secret-adapter-vault-nestjs';
+import { DataSourceOptions } from 'typeorm';
+import { BPM_CORE_MIGRATIONS } from '../migrations';
+
+const DEFAULT_PORT = 5432;
+const DEFAULT_VAULT_PATH = 'bpm_core/develop';
+
+export interface BPMDatabaseConnectionOptions {
+  readonly host: string;
+  readonly port: number;
+  readonly username: string;
+  readonly password: string;
+  readonly database: string;
+  readonly schema: string;
+}
+
+interface VaultJsonResponse {
+  readonly data?: unknown;
+  readonly auth?: unknown;
+}
+
+export async function buildTypeOrmModuleOptions(
+  vault: VaultService,
+): Promise<TypeOrmModuleOptions> {
+  const secrets = await readDatabaseSecretsFromVaultService(vault);
+
+  return {
+    ...buildBPMDataSourceOptions(secrets),
+    autoLoadEntities: true,
+  };
+}
+
+export async function buildDataSourceOptionsFromVaultEnv(
+  env: NodeJS.ProcessEnv,
+): Promise<DataSourceOptions> {
+  return buildBPMDataSourceOptions(await readDatabaseSecretsFromVaultEnv(env));
+}
+
+export function buildBPMDataSourceOptions(
+  secrets: BPMDatabaseConnectionOptions,
+): DataSourceOptions {
+  return {
+    database: secrets.database,
+    entities: [],
+    host: secrets.host,
+    migrations: [...BPM_CORE_MIGRATIONS],
+    migrationsRun: false,
+    password: secrets.password,
+    port: secrets.port,
+    schema: secrets.schema,
+    synchronize: false,
+    type: 'postgres',
+    username: secrets.username,
+  };
+}
+
+async function readDatabaseSecretsFromVaultService(
+  vault: VaultService,
+): Promise<BPMDatabaseConnectionOptions> {
+  const port = await vault.get<string>('DB_PORT');
+
+  return {
+    database: await readRequiredVaultValue(vault, 'DB_NAME'),
+    host: await readRequiredVaultValue(vault, 'DB_HOST'),
+    password: await readRequiredVaultValue(vault, 'DB_PASS'),
+    port: parseDatabasePort(port),
+    schema: await readRequiredVaultValue(vault, 'DB_SCHEMA'),
+    username: await readRequiredVaultValue(vault, 'DB_USER'),
+  };
+}
+
+async function readRequiredVaultValue(
+  vault: VaultService,
+  key: string,
+): Promise<string> {
+  const value = await vault.get<string>(key);
+
+  if (!value) {
+    throw new Error(`Missing required Vault secret: ${key}`);
+  }
+
+  return value;
+}
+
+async function readDatabaseSecretsFromVaultEnv(
+  env: NodeJS.ProcessEnv,
+): Promise<BPMDatabaseConnectionOptions> {
+  const vaultHost = readRequiredEnv(env, 'VAULT_HOST');
+  const vaultAccount = readRequiredEnv(env, 'VAULT_ACCOUNT');
+  const vaultPassword = readRequiredEnv(env, 'VAULT_PASSWORD');
+  const vaultPath = env.VAULT_PATH ?? DEFAULT_VAULT_PATH;
+  const vaultToken = await loginVault(vaultHost, vaultAccount, vaultPassword);
+  const secrets = await readVaultKvSecret(vaultHost, vaultToken, vaultPath);
+
+  return {
+    database: readRequiredSecret(secrets, 'DB_NAME'),
+    host: readRequiredSecret(secrets, 'DB_HOST'),
+    password: readRequiredSecret(secrets, 'DB_PASS'),
+    port: parseDatabasePort(readOptionalSecret(secrets, 'DB_PORT')),
+    schema: readRequiredSecret(secrets, 'DB_SCHEMA'),
+    username: readRequiredSecret(secrets, 'DB_USER'),
+  };
+}
+
+function readRequiredEnv(env: NodeJS.ProcessEnv, key: string): string {
+  const value = env[key];
+
+  if (!value) {
+    throw new Error(`Missing required environment variable: ${key}`);
+  }
+
+  return value;
+}
+
+async function loginVault(
+  vaultHost: string,
+  account: string,
+  password: string,
+): Promise<string> {
+  const response = await fetch(
+    `${trimTrailingSlash(vaultHost)}/v1/auth/userpass/login/${account}`,
+    {
+      body: JSON.stringify({ password }),
+      headers: { 'Content-Type': 'application/json' },
+      method: 'POST',
+    },
+  );
+
+  if (!response.ok) {
+    throw new Error(`Vault login failed with HTTP ${response.status}`);
+  }
+
+  const payload = (await response.json()) as VaultJsonResponse;
+  const auth = payload.auth;
+
+  if (!isRecord(auth) || typeof auth.client_token !== 'string') {
+    throw new Error('Vault login response did not include a client token');
+  }
+
+  return auth.client_token;
+}
+
+async function readVaultKvSecret(
+  vaultHost: string,
+  token: string,
+  path: string,
+): Promise<Readonly<Record<string, string>>> {
+  const response = await fetch(
+    `${trimTrailingSlash(vaultHost)}/v1/secret/data/${path}`,
+    {
+      headers: { 'X-Vault-Token': token },
+      method: 'GET',
+    },
+  );
+
+  if (!response.ok) {
+    throw new Error(`Vault secret read failed with HTTP ${response.status}`);
+  }
+
+  const payload = (await response.json()) as VaultJsonResponse;
+  const data = payload.data;
+
+  if (!isRecord(data) || !isRecord(data.data)) {
+    throw new Error('Vault KV response did not include secret data');
+  }
+
+  return Object.entries(data.data).reduce<Readonly<Record<string, string>>>(
+    (accumulator, [key, value]) => ({
+      ...accumulator,
+      ...(typeof value === 'string' ? { [key]: value } : {}),
+    }),
+    {},
+  );
+}
+
+function readRequiredSecret(
+  secrets: Readonly<Record<string, string>>,
+  key: string,
+): string {
+  const value = secrets[key];
+
+  if (!value) {
+    throw new Error(`Missing required Vault secret: ${key}`);
+  }
+
+  return value;
+}
+
+function readOptionalSecret(
+  secrets: Readonly<Record<string, string>>,
+  key: string,
+): string | undefined {
+  return secrets[key];
+}
+
+function parseDatabasePort(value: string | undefined): number {
+  if (!value) {
+    return DEFAULT_PORT;
+  }
+
+  const port = Number(value);
+
+  if (!Number.isInteger(port) || port <= 0) {
+    return DEFAULT_PORT;
+  }
+
+  return port;
+}
+
+function trimTrailingSlash(value: string): string {
+  return value.replace(/\/+$/, '');
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null;
+}

package/src/lib/delegation/delegation-rule.entity.ts

@@ -0,0 +1,84 @@
+import { Field, ID, ObjectType } from '@nestjs/graphql';
+import {
+  Column,
+  CreateDateColumn,
+  Entity,
+  PrimaryGeneratedColumn,
+  UpdateDateColumn,
+} from 'typeorm';
+import {
+  DelegationRuleStatusEnum,
+  DelegationScopeTypeEnum,
+} from './delegation.enums';
+
+@Entity('delegation_rules')
+@ObjectType('DelegationRule')
+export class DelegationRuleEntity {
+  @PrimaryGeneratedColumn('uuid')
+  @Field(() => ID)
+  id!: string;
+
+  @Column('text', { name: 'principal_member_id' })
+  @Field()
+  principalMemberId!: string;
+
+  @Column('text', { name: 'agent_member_id' })
+  @Field()
+  agentMemberId!: string;
+
+  @Column('text', { name: 'scope_type' })
+  @Field(() => DelegationScopeTypeEnum)
+  scopeType!: DelegationScopeTypeEnum;
+
+  @Column('uuid', {
+    array: true,
+    default: () => "'{}'::uuid[]",
+    name: 'scope_template_ids',
+  })
+  @Field(() => [String])
+  scopeTemplateIds!: readonly string[];
+
+  @Column('text', { name: 'scope_condition_cel', nullable: true })
+  @Field(() => String, { nullable: true })
+  scopeConditionCel!: string | null;
+
+  @Column('int', { default: 100 })
+  @Field()
+  priority!: number;
+
+  @Column('timestamptz', { name: 'start_at' })
+  @Field()
+  startAt!: Date;
+
+  @Column('timestamptz', { name: 'end_at', nullable: true })
+  @Field(() => Date, { nullable: true })
+  endAt!: Date | null;
+
+  @Column('boolean', { default: false, name: 'requires_confirmation' })
+  @Field()
+  requiresConfirmation!: boolean;
+
+  @Column('text')
+  @Field(() => DelegationRuleStatusEnum)
+  status!: DelegationRuleStatusEnum;
+
+  @Column('text', { name: 'created_by_member_id', nullable: true })
+  @Field(() => String, { nullable: true })
+  createdByMemberId!: string | null;
+
+  @CreateDateColumn({ name: 'created_at', type: 'timestamptz' })
+  @Field()
+  createdAt!: Date;
+
+  @UpdateDateColumn({ name: 'updated_at', type: 'timestamptz' })
+  @Field()
+  updatedAt!: Date;
+
+  @Column('timestamptz', { name: 'revoked_at', nullable: true })
+  @Field(() => Date, { nullable: true })
+  revokedAt!: Date | null;
+
+  @Column('text', { name: 'revoked_by_member_id', nullable: true })
+  @Field(() => String, { nullable: true })
+  revokedByMemberId!: string | null;
+}

package/src/lib/delegation/delegation.enums.ts

@@ -0,0 +1,21 @@
+import { registerEnumType } from '@nestjs/graphql';
+
+export enum DelegationRuleStatusEnum {
+  ACTIVE = 'ACTIVE',
+  EXPIRED = 'EXPIRED',
+  REVOKED = 'REVOKED',
+}
+
+export enum DelegationScopeTypeEnum {
+  ALL = 'ALL',
+  CONDITION_BASED = 'CONDITION_BASED',
+  TEMPLATE_LIST = 'TEMPLATE_LIST',
+}
+
+registerEnumType(DelegationRuleStatusEnum, {
+  name: 'DelegationRuleStatus',
+});
+
+registerEnumType(DelegationScopeTypeEnum, {
+  name: 'DelegationScopeType',
+});

package/src/lib/delegation/delegation.module.ts

@@ -0,0 +1,14 @@
+import { Module } from '@nestjs/common';
+import { TypeOrmModule } from '@nestjs/typeorm';
+import { ConditionModule } from '../condition/condition.module';
+import { DelegationRuleEntity } from './delegation-rule.entity';
+import { DelegationMutations } from './delegation.mutations';
+import { DelegationQueries } from './delegation.queries';
+import { DelegationService } from './delegation.service';
+
+@Module({
+  imports: [ConditionModule, TypeOrmModule.forFeature([DelegationRuleEntity])],
+  providers: [DelegationMutations, DelegationQueries, DelegationService],
+  exports: [DelegationService],
+})
+export class DelegationModule {}

package/src/lib/delegation/delegation.mutations.ts

@@ -0,0 +1,92 @@
+import { ForbiddenException } from '@nestjs/common';
+import { Args, Mutation, Resolver } from '@nestjs/graphql';
+import {
+  BPMAuthenticated,
+  BPMAuthContext,
+  BPMCurrentAuthContext,
+  BPMCurrentMemberId,
+  isBPMAdmin,
+} from '../bpm-auth';
+import {
+  CreateDelegationRuleInput,
+  UpdateDelegationRuleInput,
+} from './dto/delegation-rule.input';
+import { DelegationRuleEntity } from './delegation-rule.entity';
+import { DelegationService } from './delegation.service';
+
+@Resolver(() => DelegationRuleEntity)
+@BPMAuthenticated()
+export class DelegationMutations {
+  constructor(private readonly delegationService: DelegationService) {}
+
+  @Mutation(() => DelegationRuleEntity)
+  createDelegationRule(
+    @Args('input') input: CreateDelegationRuleInput,
+    @BPMCurrentAuthContext() authContext: BPMAuthContext | null,
+    @BPMCurrentMemberId() currentMemberId: string,
+  ): Promise<DelegationRuleEntity> {
+    assertCanWriteDelegationForPrincipal({
+      authContext,
+      principalMemberId: input.principalMemberId,
+    });
+
+    return this.delegationService.createDelegationRule({
+      ...input,
+      createdByMemberId: currentMemberId,
+    });
+  }
+
+  @Mutation(() => DelegationRuleEntity)
+  async updateDelegationRule(
+    @Args('input') input: UpdateDelegationRuleInput,
+    @BPMCurrentAuthContext() authContext: BPMAuthContext | null,
+  ): Promise<DelegationRuleEntity> {
+    const rule = await this.delegationService.getDelegationRule(input.id);
+
+    assertCanWriteDelegationForPrincipal({
+      authContext,
+      principalMemberId: rule.principalMemberId,
+    });
+
+    return this.delegationService.updateDelegationRule(input);
+  }
+
+  @Mutation(() => DelegationRuleEntity)
+  async revokeDelegationRule(
+    @Args('id', { type: () => String }) id: string,
+    @Args('revokedByMemberId', { nullable: true, type: () => String })
+    revokedByMemberId?: string | null,
+    @BPMCurrentAuthContext() authContext?: BPMAuthContext | null,
+    @BPMCurrentMemberId() currentMemberId?: string,
+  ): Promise<DelegationRuleEntity> {
+    const rule = await this.delegationService.getDelegationRule(id);
+
+    assertCanWriteDelegationForPrincipal({
+      authContext,
+      principalMemberId: rule.principalMemberId,
+    });
+
+    return this.delegationService.revokeDelegationRule({
+      id,
+      revokedByMemberId: currentMemberId ?? revokedByMemberId,
+    });
+  }
+}
+
+function assertCanWriteDelegationForPrincipal({
+  authContext,
+  principalMemberId,
+}: {
+  readonly authContext?: BPMAuthContext | null;
+  readonly principalMemberId: string;
+}): void {
+  if (!authContext) {
+    throw new ForbiddenException('BPM member context is required');
+  }
+
+  if (isBPMAdmin(authContext) || principalMemberId === authContext.memberId) {
+    return;
+  }
+
+  throw new ForbiddenException('BPM admin permission is required');
+}

package/src/lib/delegation/delegation.queries.ts

@@ -0,0 +1,111 @@
+import { ForbiddenException } from '@nestjs/common';
+import { Args, Int, Query, Resolver } from '@nestjs/graphql';
+import {
+  BPMAuthenticated,
+  BPMAuthContext,
+  BPMCurrentAuthContext,
+  isBPMAdmin,
+} from '../bpm-auth';
+import { DelegationRuleEntity } from './delegation-rule.entity';
+import {
+  DelegationRuleStatusEnum,
+  DelegationScopeTypeEnum,
+} from './delegation.enums';
+import { DelegationService } from './delegation.service';
+
+@Resolver(() => DelegationRuleEntity)
+@BPMAuthenticated()
+export class DelegationQueries {
+  constructor(private readonly delegationService: DelegationService) {}
+
+  @Query(() => [DelegationRuleEntity])
+  delegationRules(
+    @Args('principalMemberId', { nullable: true, type: () => String })
+    principalMemberId?: string | null,
+    @Args('agentMemberId', { nullable: true, type: () => String })
+    agentMemberId?: string | null,
+    @Args('includeInactive', { nullable: true, type: () => Boolean })
+    includeInactive?: boolean | null,
+    @Args('page', { nullable: true, type: () => Int })
+    page?: number | null,
+    @Args('pageSize', { nullable: true, type: () => Int })
+    pageSize?: number | null,
+    @Args('status', { nullable: true, type: () => DelegationRuleStatusEnum })
+    status?: DelegationRuleStatusEnum | null,
+    @Args('scopeType', { nullable: true, type: () => DelegationScopeTypeEnum })
+    scopeType?: DelegationScopeTypeEnum | null,
+    @BPMCurrentAuthContext() authContext?: BPMAuthContext | null,
+  ): Promise<readonly DelegationRuleEntity[]> {
+    assertDelegationRuleQueryAllowed({
+      agentMemberId,
+      authContext,
+      principalMemberId,
+    });
+
+    return this.delegationService.listDelegationRules({
+      agentMemberId,
+      includeInactive: includeInactive ?? false,
+      page: page ?? undefined,
+      pageSize: pageSize ?? undefined,
+      principalMemberId,
+      scopeType,
+      status: status ?? undefined,
+    });
+  }
+
+  @Query(() => Int)
+  delegationRuleCount(
+    @Args('principalMemberId', { nullable: true, type: () => String })
+    principalMemberId?: string | null,
+    @Args('agentMemberId', { nullable: true, type: () => String })
+    agentMemberId?: string | null,
+    @Args('includeInactive', { nullable: true, type: () => Boolean })
+    includeInactive?: boolean | null,
+    @Args('status', { nullable: true, type: () => DelegationRuleStatusEnum })
+    status?: DelegationRuleStatusEnum | null,
+    @Args('scopeType', { nullable: true, type: () => DelegationScopeTypeEnum })
+    scopeType?: DelegationScopeTypeEnum | null,
+    @BPMCurrentAuthContext() authContext?: BPMAuthContext | null,
+  ): Promise<number> {
+    assertDelegationRuleQueryAllowed({
+      agentMemberId,
+      authContext,
+      principalMemberId,
+    });
+
+    return this.delegationService.countDelegationRules({
+      agentMemberId,
+      includeInactive: includeInactive ?? false,
+      principalMemberId,
+      scopeType,
+      status: status ?? undefined,
+    });
+  }
+}
+
+function assertDelegationRuleQueryAllowed({
+  agentMemberId,
+  authContext,
+  principalMemberId,
+}: {
+  readonly agentMemberId?: string | null;
+  readonly authContext?: BPMAuthContext | null;
+  readonly principalMemberId?: string | null;
+}): void {
+  if (!authContext) {
+    throw new ForbiddenException('BPM member context is required');
+  }
+
+  if (isBPMAdmin(authContext)) {
+    return;
+  }
+
+  if (
+    principalMemberId === authContext.memberId ||
+    agentMemberId === authContext.memberId
+  ) {
+    return;
+  }
+
+  throw new ForbiddenException('BPM admin permission is required');
+}