@rytass/bpm-core-nestjs-module 0.5.0 → 0.5.1

package/src/lib/database/typeorm.config.ts

@@ -1,217 +0,0 @@
-import { TypeOrmModuleOptions } from '@nestjs/typeorm';
-import { VaultService } from '@rytass/secret-adapter-vault-nestjs';
-import { DataSourceOptions } from 'typeorm';
-import { BPM_CORE_MIGRATIONS } from '../migrations';
-
-const DEFAULT_PORT = 5432;
-const DEFAULT_VAULT_PATH = 'bpm_core/develop';
-
-export interface BPMDatabaseConnectionOptions {
-  readonly host: string;
-  readonly port: number;
-  readonly username: string;
-  readonly password: string;
-  readonly database: string;
-  readonly schema: string;
-}
-
-interface VaultJsonResponse {
-  readonly data?: unknown;
-  readonly auth?: unknown;
-}
-
-export async function buildTypeOrmModuleOptions(
-  vault: VaultService,
-): Promise<TypeOrmModuleOptions> {
-  const secrets = await readDatabaseSecretsFromVaultService(vault);
-
-  return {
-    ...buildBPMDataSourceOptions(secrets),
-    autoLoadEntities: true,
-  };
-}
-
-export async function buildDataSourceOptionsFromVaultEnv(
-  env: NodeJS.ProcessEnv,
-): Promise<DataSourceOptions> {
-  return buildBPMDataSourceOptions(await readDatabaseSecretsFromVaultEnv(env));
-}
-
-export function buildBPMDataSourceOptions(
-  secrets: BPMDatabaseConnectionOptions,
-): DataSourceOptions {
-  return {
-    database: secrets.database,
-    entities: [],
-    host: secrets.host,
-    migrations: [...BPM_CORE_MIGRATIONS],
-    migrationsRun: false,
-    password: secrets.password,
-    port: secrets.port,
-    schema: secrets.schema,
-    synchronize: false,
-    type: 'postgres',
-    username: secrets.username,
-  };
-}
-
-async function readDatabaseSecretsFromVaultService(
-  vault: VaultService,
-): Promise<BPMDatabaseConnectionOptions> {
-  const port = await vault.get<string>('DB_PORT');
-
-  return {
-    database: await readRequiredVaultValue(vault, 'DB_NAME'),
-    host: await readRequiredVaultValue(vault, 'DB_HOST'),
-    password: await readRequiredVaultValue(vault, 'DB_PASS'),
-    port: parseDatabasePort(port),
-    schema: await readRequiredVaultValue(vault, 'DB_SCHEMA'),
-    username: await readRequiredVaultValue(vault, 'DB_USER'),
-  };
-}
-
-async function readRequiredVaultValue(
-  vault: VaultService,
-  key: string,
-): Promise<string> {
-  const value = await vault.get<string>(key);
-
-  if (!value) {
-    throw new Error(`Missing required Vault secret: ${key}`);
-  }
-
-  return value;
-}
-
-async function readDatabaseSecretsFromVaultEnv(
-  env: NodeJS.ProcessEnv,
-): Promise<BPMDatabaseConnectionOptions> {
-  const vaultHost = readRequiredEnv(env, 'VAULT_HOST');
-  const vaultAccount = readRequiredEnv(env, 'VAULT_ACCOUNT');
-  const vaultPassword = readRequiredEnv(env, 'VAULT_PASSWORD');
-  const vaultPath = env.VAULT_PATH ?? DEFAULT_VAULT_PATH;
-  const vaultToken = await loginVault(vaultHost, vaultAccount, vaultPassword);
-  const secrets = await readVaultKvSecret(vaultHost, vaultToken, vaultPath);
-
-  return {
-    database: readRequiredSecret(secrets, 'DB_NAME'),
-    host: readRequiredSecret(secrets, 'DB_HOST'),
-    password: readRequiredSecret(secrets, 'DB_PASS'),
-    port: parseDatabasePort(readOptionalSecret(secrets, 'DB_PORT')),
-    schema: readRequiredSecret(secrets, 'DB_SCHEMA'),
-    username: readRequiredSecret(secrets, 'DB_USER'),
-  };
-}
-
-function readRequiredEnv(env: NodeJS.ProcessEnv, key: string): string {
-  const value = env[key];
-
-  if (!value) {
-    throw new Error(`Missing required environment variable: ${key}`);
-  }
-
-  return value;
-}
-
-async function loginVault(
-  vaultHost: string,
-  account: string,
-  password: string,
-): Promise<string> {
-  const response = await fetch(
-    `${trimTrailingSlash(vaultHost)}/v1/auth/userpass/login/${account}`,
-    {
-      body: JSON.stringify({ password }),
-      headers: { 'Content-Type': 'application/json' },
-      method: 'POST',
-    },
-  );
-
-  if (!response.ok) {
-    throw new Error(`Vault login failed with HTTP ${response.status}`);
-  }
-
-  const payload = (await response.json()) as VaultJsonResponse;
-  const auth = payload.auth;
-
-  if (!isRecord(auth) || typeof auth.client_token !== 'string') {
-    throw new Error('Vault login response did not include a client token');
-  }
-
-  return auth.client_token;
-}
-
-async function readVaultKvSecret(
-  vaultHost: string,
-  token: string,
-  path: string,
-): Promise<Readonly<Record<string, string>>> {
-  const response = await fetch(
-    `${trimTrailingSlash(vaultHost)}/v1/secret/data/${path}`,
-    {
-      headers: { 'X-Vault-Token': token },
-      method: 'GET',
-    },
-  );
-
-  if (!response.ok) {
-    throw new Error(`Vault secret read failed with HTTP ${response.status}`);
-  }
-
-  const payload = (await response.json()) as VaultJsonResponse;
-  const data = payload.data;
-
-  if (!isRecord(data) || !isRecord(data.data)) {
-    throw new Error('Vault KV response did not include secret data');
-  }
-
-  return Object.entries(data.data).reduce<Readonly<Record<string, string>>>(
-    (accumulator, [key, value]) => ({
-      ...accumulator,
-      ...(typeof value === 'string' ? { [key]: value } : {}),
-    }),
-    {},
-  );
-}
-
-function readRequiredSecret(
-  secrets: Readonly<Record<string, string>>,
-  key: string,
-): string {
-  const value = secrets[key];
-
-  if (!value) {
-    throw new Error(`Missing required Vault secret: ${key}`);
-  }
-
-  return value;
-}
-
-function readOptionalSecret(
-  secrets: Readonly<Record<string, string>>,
-  key: string,
-): string | undefined {
-  return secrets[key];
-}
-
-function parseDatabasePort(value: string | undefined): number {
-  if (!value) {
-    return DEFAULT_PORT;
-  }
-
-  const port = Number(value);
-
-  if (!Number.isInteger(port) || port <= 0) {
-    return DEFAULT_PORT;
-  }
-
-  return port;
-}
-
-function trimTrailingSlash(value: string): string {
-  return value.replace(/\/+$/, '');
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null;
-}

package/src/lib/delegation/delegation-rule.entity.ts

@@ -1,84 +0,0 @@
-import { Field, ID, ObjectType } from '@nestjs/graphql';
-import {
-  Column,
-  CreateDateColumn,
-  Entity,
-  PrimaryGeneratedColumn,
-  UpdateDateColumn,
-} from 'typeorm';
-import {
-  DelegationRuleStatusEnum,
-  DelegationScopeTypeEnum,
-} from './delegation.enums';
-
-@Entity('delegation_rules')
-@ObjectType('DelegationRule')
-export class DelegationRuleEntity {
-  @PrimaryGeneratedColumn('uuid')
-  @Field(() => ID)
-  id!: string;
-
-  @Column('text', { name: 'principal_member_id' })
-  @Field()
-  principalMemberId!: string;
-
-  @Column('text', { name: 'agent_member_id' })
-  @Field()
-  agentMemberId!: string;
-
-  @Column('text', { name: 'scope_type' })
-  @Field(() => DelegationScopeTypeEnum)
-  scopeType!: DelegationScopeTypeEnum;
-
-  @Column('uuid', {
-    array: true,
-    default: () => "'{}'::uuid[]",
-    name: 'scope_template_ids',
-  })
-  @Field(() => [String])
-  scopeTemplateIds!: readonly string[];
-
-  @Column('text', { name: 'scope_condition_cel', nullable: true })
-  @Field(() => String, { nullable: true })
-  scopeConditionCel!: string | null;
-
-  @Column('int', { default: 100 })
-  @Field()
-  priority!: number;
-
-  @Column('timestamptz', { name: 'start_at' })
-  @Field()
-  startAt!: Date;
-
-  @Column('timestamptz', { name: 'end_at', nullable: true })
-  @Field(() => Date, { nullable: true })
-  endAt!: Date | null;
-
-  @Column('boolean', { default: false, name: 'requires_confirmation' })
-  @Field()
-  requiresConfirmation!: boolean;
-
-  @Column('text')
-  @Field(() => DelegationRuleStatusEnum)
-  status!: DelegationRuleStatusEnum;
-
-  @Column('text', { name: 'created_by_member_id', nullable: true })
-  @Field(() => String, { nullable: true })
-  createdByMemberId!: string | null;
-
-  @CreateDateColumn({ name: 'created_at', type: 'timestamptz' })
-  @Field()
-  createdAt!: Date;
-
-  @UpdateDateColumn({ name: 'updated_at', type: 'timestamptz' })
-  @Field()
-  updatedAt!: Date;
-
-  @Column('timestamptz', { name: 'revoked_at', nullable: true })
-  @Field(() => Date, { nullable: true })
-  revokedAt!: Date | null;
-
-  @Column('text', { name: 'revoked_by_member_id', nullable: true })
-  @Field(() => String, { nullable: true })
-  revokedByMemberId!: string | null;
-}

package/src/lib/delegation/delegation.enums.ts

@@ -1,21 +0,0 @@
-import { registerEnumType } from '@nestjs/graphql';
-
-export enum DelegationRuleStatusEnum {
-  ACTIVE = 'ACTIVE',
-  EXPIRED = 'EXPIRED',
-  REVOKED = 'REVOKED',
-}
-
-export enum DelegationScopeTypeEnum {
-  ALL = 'ALL',
-  CONDITION_BASED = 'CONDITION_BASED',
-  TEMPLATE_LIST = 'TEMPLATE_LIST',
-}
-
-registerEnumType(DelegationRuleStatusEnum, {
-  name: 'DelegationRuleStatus',
-});
-
-registerEnumType(DelegationScopeTypeEnum, {
-  name: 'DelegationScopeType',
-});

package/src/lib/delegation/delegation.module.ts

@@ -1,14 +0,0 @@
-import { Module } from '@nestjs/common';
-import { TypeOrmModule } from '@nestjs/typeorm';
-import { ConditionModule } from '../condition/condition.module';
-import { DelegationRuleEntity } from './delegation-rule.entity';
-import { DelegationMutations } from './delegation.mutations';
-import { DelegationQueries } from './delegation.queries';
-import { DelegationService } from './delegation.service';
-
-@Module({
-  imports: [ConditionModule, TypeOrmModule.forFeature([DelegationRuleEntity])],
-  providers: [DelegationMutations, DelegationQueries, DelegationService],
-  exports: [DelegationService],
-})
-export class DelegationModule {}

package/src/lib/delegation/delegation.mutations.ts

@@ -1,92 +0,0 @@
-import { ForbiddenException } from '@nestjs/common';
-import { Args, Mutation, Resolver } from '@nestjs/graphql';
-import {
-  BPMAuthenticated,
-  BPMAuthContext,
-  BPMCurrentAuthContext,
-  BPMCurrentMemberId,
-  isBPMAdmin,
-} from '../bpm-auth';
-import {
-  CreateDelegationRuleInput,
-  UpdateDelegationRuleInput,
-} from './dto/delegation-rule.input';
-import { DelegationRuleEntity } from './delegation-rule.entity';
-import { DelegationService } from './delegation.service';
-
-@Resolver(() => DelegationRuleEntity)
-@BPMAuthenticated()
-export class DelegationMutations {
-  constructor(private readonly delegationService: DelegationService) {}
-
-  @Mutation(() => DelegationRuleEntity)
-  createDelegationRule(
-    @Args('input') input: CreateDelegationRuleInput,
-    @BPMCurrentAuthContext() authContext: BPMAuthContext | null,
-    @BPMCurrentMemberId() currentMemberId: string,
-  ): Promise<DelegationRuleEntity> {
-    assertCanWriteDelegationForPrincipal({
-      authContext,
-      principalMemberId: input.principalMemberId,
-    });
-
-    return this.delegationService.createDelegationRule({
-      ...input,
-      createdByMemberId: currentMemberId,
-    });
-  }
-
-  @Mutation(() => DelegationRuleEntity)
-  async updateDelegationRule(
-    @Args('input') input: UpdateDelegationRuleInput,
-    @BPMCurrentAuthContext() authContext: BPMAuthContext | null,
-  ): Promise<DelegationRuleEntity> {
-    const rule = await this.delegationService.getDelegationRule(input.id);
-
-    assertCanWriteDelegationForPrincipal({
-      authContext,
-      principalMemberId: rule.principalMemberId,
-    });
-
-    return this.delegationService.updateDelegationRule(input);
-  }
-
-  @Mutation(() => DelegationRuleEntity)
-  async revokeDelegationRule(
-    @Args('id', { type: () => String }) id: string,
-    @Args('revokedByMemberId', { nullable: true, type: () => String })
-    revokedByMemberId?: string | null,
-    @BPMCurrentAuthContext() authContext?: BPMAuthContext | null,
-    @BPMCurrentMemberId() currentMemberId?: string,
-  ): Promise<DelegationRuleEntity> {
-    const rule = await this.delegationService.getDelegationRule(id);
-
-    assertCanWriteDelegationForPrincipal({
-      authContext,
-      principalMemberId: rule.principalMemberId,
-    });
-
-    return this.delegationService.revokeDelegationRule({
-      id,
-      revokedByMemberId: currentMemberId ?? revokedByMemberId,
-    });
-  }
-}
-
-function assertCanWriteDelegationForPrincipal({
-  authContext,
-  principalMemberId,
-}: {
-  readonly authContext?: BPMAuthContext | null;
-  readonly principalMemberId: string;
-}): void {
-  if (!authContext) {
-    throw new ForbiddenException('BPM member context is required');
-  }
-
-  if (isBPMAdmin(authContext) || principalMemberId === authContext.memberId) {
-    return;
-  }
-
-  throw new ForbiddenException('BPM admin permission is required');
-}

package/src/lib/delegation/delegation.queries.ts

@@ -1,111 +0,0 @@
-import { ForbiddenException } from '@nestjs/common';
-import { Args, Int, Query, Resolver } from '@nestjs/graphql';
-import {
-  BPMAuthenticated,
-  BPMAuthContext,
-  BPMCurrentAuthContext,
-  isBPMAdmin,
-} from '../bpm-auth';
-import { DelegationRuleEntity } from './delegation-rule.entity';
-import {
-  DelegationRuleStatusEnum,
-  DelegationScopeTypeEnum,
-} from './delegation.enums';
-import { DelegationService } from './delegation.service';
-
-@Resolver(() => DelegationRuleEntity)
-@BPMAuthenticated()
-export class DelegationQueries {
-  constructor(private readonly delegationService: DelegationService) {}
-
-  @Query(() => [DelegationRuleEntity])
-  delegationRules(
-    @Args('principalMemberId', { nullable: true, type: () => String })
-    principalMemberId?: string | null,
-    @Args('agentMemberId', { nullable: true, type: () => String })
-    agentMemberId?: string | null,
-    @Args('includeInactive', { nullable: true, type: () => Boolean })
-    includeInactive?: boolean | null,
-    @Args('page', { nullable: true, type: () => Int })
-    page?: number | null,
-    @Args('pageSize', { nullable: true, type: () => Int })
-    pageSize?: number | null,
-    @Args('status', { nullable: true, type: () => DelegationRuleStatusEnum })
-    status?: DelegationRuleStatusEnum | null,
-    @Args('scopeType', { nullable: true, type: () => DelegationScopeTypeEnum })
-    scopeType?: DelegationScopeTypeEnum | null,
-    @BPMCurrentAuthContext() authContext?: BPMAuthContext | null,
-  ): Promise<readonly DelegationRuleEntity[]> {
-    assertDelegationRuleQueryAllowed({
-      agentMemberId,
-      authContext,
-      principalMemberId,
-    });
-
-    return this.delegationService.listDelegationRules({
-      agentMemberId,
-      includeInactive: includeInactive ?? false,
-      page: page ?? undefined,
-      pageSize: pageSize ?? undefined,
-      principalMemberId,
-      scopeType,
-      status: status ?? undefined,
-    });
-  }
-
-  @Query(() => Int)
-  delegationRuleCount(
-    @Args('principalMemberId', { nullable: true, type: () => String })
-    principalMemberId?: string | null,
-    @Args('agentMemberId', { nullable: true, type: () => String })
-    agentMemberId?: string | null,
-    @Args('includeInactive', { nullable: true, type: () => Boolean })
-    includeInactive?: boolean | null,
-    @Args('status', { nullable: true, type: () => DelegationRuleStatusEnum })
-    status?: DelegationRuleStatusEnum | null,
-    @Args('scopeType', { nullable: true, type: () => DelegationScopeTypeEnum })
-    scopeType?: DelegationScopeTypeEnum | null,
-    @BPMCurrentAuthContext() authContext?: BPMAuthContext | null,
-  ): Promise<number> {
-    assertDelegationRuleQueryAllowed({
-      agentMemberId,
-      authContext,
-      principalMemberId,
-    });
-
-    return this.delegationService.countDelegationRules({
-      agentMemberId,
-      includeInactive: includeInactive ?? false,
-      principalMemberId,
-      scopeType,
-      status: status ?? undefined,
-    });
-  }
-}
-
-function assertDelegationRuleQueryAllowed({
-  agentMemberId,
-  authContext,
-  principalMemberId,
-}: {
-  readonly agentMemberId?: string | null;
-  readonly authContext?: BPMAuthContext | null;
-  readonly principalMemberId?: string | null;
-}): void {
-  if (!authContext) {
-    throw new ForbiddenException('BPM member context is required');
-  }
-
-  if (isBPMAdmin(authContext)) {
-    return;
-  }
-
-  if (
-    principalMemberId === authContext.memberId ||
-    agentMemberId === authContext.memberId
-  ) {
-    return;
-  }
-
-  throw new ForbiddenException('BPM admin permission is required');
-}