@servicelabsco/nestjs-utility-services 2.0.14 → 3.0.1

package/dist/system/libraries/report.batch.paginator.js

@@ -0,0 +1,136 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReportBatchPaginator = void 0;
+const operation_exception_1 = require("../../common/exceptions/operation.exception");
+class ReportBatchPaginator {
+    constructor(baseSql, batchSize, options) {
+        this.baseSql = baseSql;
+        this.batchSize = batchSize;
+        this.options = options;
+        const orderBy = this.extractOrderBy(baseSql);
+        if (!orderBy) {
+            throw new operation_exception_1.OperationException('Report query must declare an ORDER BY for deterministic keyset pagination.');
+        }
+        const terms = this.parseOrderBy(orderBy);
+        if (!terms.length) {
+            throw new operation_exception_1.OperationException(`Unable to parse a safe ORDER BY for keyset pagination: ${orderBy}`);
+        }
+        this.direction = this.resolveDirection(terms);
+        this.orderTerms = this.appendTiebreaker(terms);
+        this.cursorColumns = this.orderTerms.map((term) => this.unquote(term.column));
+    }
+    buildQuery(_iteration, cursor) {
+        const orderClause = this.orderTerms.map((term) => `${this.quote(term.column)} ${term.direction} nulls ${term.nulls}`).join(', ');
+        const predicate = this.buildSeekPredicate(cursor);
+        return `select * from (${this.baseSql}) kp${predicate} order by ${orderClause} limit ${this.batchSize}`;
+    }
+    nextCursor(rows) {
+        if (!rows.length)
+            return undefined;
+        const lastRow = rows[rows.length - 1];
+        const cursor = {};
+        for (const column of this.cursorColumns) {
+            cursor[column] = lastRow[column];
+        }
+        return cursor;
+    }
+    buildSeekPredicate(cursor) {
+        if (typeof cursor === 'undefined' || cursor === null)
+            return '';
+        const branches = [];
+        this.orderTerms.forEach((term, index) => {
+            const after = this.buildAfterComparison(term, cursor[this.cursorColumns[index]]);
+            if (!after)
+                return;
+            const equalities = this.orderTerms
+                .slice(0, index)
+                .map((earlier, position) => this.buildEqualityComparison(earlier, cursor[this.cursorColumns[position]]));
+            branches.push(equalities.length ? `(${[...equalities, after].join(' and ')})` : after);
+        });
+        if (!branches.length)
+            return ' where false';
+        return ` where (${branches.join(' or ')})`;
+    }
+    buildEqualityComparison(term, value) {
+        const column = this.quote(term.column);
+        if (this.isNull(value))
+            return `${column} is null`;
+        return `${column} = ${this.formatValue(value)}`;
+    }
+    buildAfterComparison(term, value) {
+        const column = this.quote(term.column);
+        const operator = term.direction === 'asc' ? '>' : '<';
+        if (this.isNull(value))
+            return term.nulls === 'first' ? `${column} is not null` : null;
+        const comparison = `${column} ${operator} ${this.formatValue(value)}`;
+        return term.nulls === 'last' ? `(${comparison} or ${column} is null)` : comparison;
+    }
+    isNull(value) {
+        return value === null || typeof value === 'undefined';
+    }
+    formatValue(value) {
+        if (this.isNull(value))
+            return 'null';
+        if (typeof value === 'number' || typeof value === 'boolean')
+            return String(value);
+        return `'${this.options.escapeSqlString(value)}'`;
+    }
+    extractOrderBy(sql) {
+        const match = /order\s+by\s+([\s\S]+?)\s*(?:limit\s+\d+\s*(?:offset\s+\d+)?\s*)?(?:\)\s*\w*\s*)?;?\s*$/i.exec(sql);
+        if (!match)
+            return null;
+        const clause = match[1].trim();
+        return clause.length ? clause : null;
+    }
+    parseOrderBy(clause) {
+        const terms = [];
+        for (const raw of clause.split(',')) {
+            const part = raw.trim();
+            const tokenMatch = /^(.+?)(?:\s+(asc|desc))?(?:\s+nulls\s+(first|last))?$/i.exec(part);
+            if (!tokenMatch)
+                return [];
+            const column = tokenMatch[1].trim();
+            const direction = tokenMatch[2]?.toLowerCase() || 'asc';
+            if (!this.options.isSafeIdentifier(column))
+                return [];
+            terms.push({ column, direction, nulls: tokenMatch[3]?.toLowerCase() || this.defaultNulls(direction) });
+        }
+        return terms;
+    }
+    defaultNulls(direction) {
+        return direction === 'asc' ? 'last' : 'first';
+    }
+    resolveDirection(terms) {
+        const directions = new Set(terms.map((term) => term.direction));
+        if (directions.size > 1) {
+            throw new operation_exception_1.OperationException('Report ORDER BY mixes ASC and DESC directions; keyset pagination needs a uniform direction. Use a single sort direction.');
+        }
+        return terms[0].direction;
+    }
+    appendTiebreaker(terms) {
+        const tiebreaker = this.options.tiebreaker;
+        if (!tiebreaker) {
+            throw new operation_exception_1.OperationException('Report keyset pagination needs a unique tiebreaker column (e.g. the result set id); none was derivable.');
+        }
+        if (!this.options.isSafeIdentifier(tiebreaker)) {
+            throw new operation_exception_1.OperationException(`Report pagination tiebreaker is not a safe SQL identifier: ${tiebreaker}`);
+        }
+        const tiebreakerName = this.unquote(tiebreaker);
+        const lastTerm = terms[terms.length - 1];
+        if (this.unquote(lastTerm.column) === tiebreakerName)
+            return terms;
+        return [...terms, { column: tiebreaker, direction: this.direction, nulls: this.defaultNulls(this.direction) }];
+    }
+    quote(identifier) {
+        return identifier
+            .split('.')
+            .map((segment) => (segment.startsWith('"') ? segment : `"${segment}"`))
+            .join('.');
+    }
+    unquote(identifier) {
+        const last = identifier.split('.').pop();
+        return last.replace(/"/g, '');
+    }
+}
+exports.ReportBatchPaginator = ReportBatchPaginator;
+//# sourceMappingURL=report.batch.paginator.js.map

package/dist/system/libraries/report.batch.paginator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.batch.paginator.js","sourceRoot":"","sources":["../../../src/system/libraries/report.batch.paginator.ts"],"names":[],"mappings":";;;AAAA,qFAAiF;AAwFjF,MAAa,oBAAoB;IAgB7B,YACqB,OAAe,EACf,SAAiB,EACjB,OAAoC;QAFpC,YAAO,GAAP,OAAO,CAAQ;QACf,cAAS,GAAT,SAAS,CAAQ;QACjB,YAAO,GAAP,OAAO,CAA6B;QAErD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,wCAAkB,CAAC,4EAA4E,CAAC,CAAC;QAC/G,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,wCAAkB,CAAC,0DAA0D,OAAO,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAClF,CAAC;IAaD,UAAU,CAAC,UAAkB,EAAE,MAAW;QAItC,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjI,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAElD,OAAO,kBAAkB,IAAI,CAAC,OAAO,OAAO,SAAS,aAAa,WAAW,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC;IAC5G,CAAC;IASD,UAAU,CAAC,IAAW;QAClB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAEnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACtC,MAAM,MAAM,GAAwB,EAAE,CAAC;QACvC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAgBO,kBAAkB,CAAC,MAAW;QAClC,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QAEhE,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YACpC,MAAM,KAAK,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjF,IAAI,CAAC,KAAK;gBAAE,OAAO;YAEnB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU;iBAC7B,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;iBACf,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAE7G,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,UAAU,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC3F,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO,cAAc,CAAC;QAE5C,OAAO,WAAW,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;IAC/C,CAAC;IAWO,uBAAuB,CAAC,IAAqB,EAAE,KAAU;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEvC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,GAAG,MAAM,UAAU,CAAC;QAEnD,OAAO,GAAG,MAAM,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;IACpD,CAAC;IAWO,oBAAoB,CAAC,IAAqB,EAAE,KAAU;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAItD,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;QAMvF,MAAM,UAAU,GAAG,GAAG,MAAM,IAAI,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QAEtE,OAAO,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,UAAU,OAAO,MAAM,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC;IACvF,CAAC;IAMO,MAAM,CAAC,KAAU;QACrB,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,WAAW,CAAC;IAC1D,CAAC;IAeO,WAAW,CAAC,KAAU;QAC1B,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QAClF,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC;IACtD,CAAC;IAcO,cAAc,CAAC,GAAW;QAC9B,MAAM,KAAK,GAAG,0FAA0F,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnH,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAaO,YAAY,CAAC,MAAc;QAC/B,MAAM,KAAK,GAAsB,EAAE,CAAC;QAEpC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YAIxB,MAAM,UAAU,GAAG,wDAAwD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvF,IAAI,CAAC,UAAU;gBAAE,OAAO,EAAE,CAAC;YAE3B,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,SAAS,GAAI,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAqB,IAAI,KAAK,CAAC;YAE5E,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,CAAC;YAEtD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAG,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAuB,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACjI,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC;IASO,YAAY,CAAC,SAAyB;QAC1C,OAAO,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAClD,CAAC;IAWO,gBAAgB,CAAC,KAAwB;QAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAChE,IAAI,UAAU,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,wCAAkB,CACxB,0HAA0H,CAC7H,CAAC;QACN,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9B,CAAC;IAWO,gBAAgB,CAAC,KAAwB;QAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,MAAM,IAAI,wCAAkB,CAAC,yGAAyG,CAAC,CAAC;QAC5I,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,wCAAkB,CAAC,8DAA8D,UAAU,EAAE,CAAC,CAAC;QAC7G,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,cAAc;YAAE,OAAO,KAAK,CAAC;QAInE,OAAO,CAAC,GAAG,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnH,CAAC;IAOO,KAAK,CAAC,UAAkB;QAC5B,OAAO,UAAU;aACZ,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;aACtE,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAOO,OAAO,CAAC,UAAkB;QAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAY,CAAC;QACnD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAClC,CAAC;CACJ;AAvTD,oDAuTC"}

package/dist/system/libraries/sandboxed.script.executor.d.ts

@@ -0,0 +1,34 @@
+export interface SandboxOptionsInterface {
+    timeoutMs?: number;
+    context?: Record<string, unknown>;
+    bridge?: Record<string, unknown>;
+}
+export interface SandboxResultInterface<T = unknown> {
+    ok: boolean;
+    value: T;
+    error?: string;
+    context: Record<string, unknown>;
+}
+export declare class SandboxedScriptExecutor {
+    private static readonly DENIED_MEMBERS;
+    private static readonly ISO_TIMESTAMP;
+    private static readonly MAX_CLONE_DEPTH;
+    private static readonly MAX_BRIDGE_DEPTH;
+    execute(script: string, options?: SandboxOptionsInterface): SandboxResultInterface;
+    executeAsync(script: string, options?: SandboxOptionsInterface): Promise<SandboxResultInterface>;
+    invokeMethod(target: any, method: string, args?: any[]): any;
+    writeBack(target: any, source: any): void;
+    private rejectHostCallables;
+    private findHostCallable;
+    private blankScriptResult;
+    private plainContext;
+    private prepare;
+    private describeBridge;
+    private invokeBridge;
+    private decodeArgs;
+    private encode;
+    private exportContext;
+    private toPlain;
+    private isDeclaredMember;
+    private reason;
+}

package/dist/system/libraries/sandboxed.script.executor.js

@@ -0,0 +1,416 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SandboxedScriptExecutor = void 0;
+const vm_1 = require("vm");
+const operation_exception_1 = require("../../common/exceptions/operation.exception");
+const SANDBOX_BOOTSTRAP = `
+(function (transfer, shape, invoke) {
+    'use strict';
+
+    function reason(err) {
+        try {
+            if (err && err.message) return String(err.message);
+            return String(err);
+        } catch (ignored) {
+            return 'sandbox bridge failure';
+        }
+    }
+
+    function decode(json) {
+        if (json === undefined || json === null) return undefined;
+        return JSON.parse(json);
+    }
+
+    function wrap(id) {
+        return function () {
+            var payload;
+            try {
+                payload = JSON.stringify(Array.prototype.slice.call(arguments));
+            } catch (err) {
+                throw new Error('sandbox bridge: arguments must be plain, serialisable data');
+            }
+
+            var out;
+            try {
+                out = invoke(id, payload);
+            } catch (err) {
+                throw new Error(reason(err));
+            }
+
+            if (out && typeof out.then === 'function') {
+                return new Promise(function (resolve, reject) {
+                    out.then(
+                        function (value) {
+                            try {
+                                resolve(decode(value));
+                            } catch (err) {
+                                reject(new Error(reason(err)));
+                            }
+                        },
+                        function (err) {
+                            reject(new Error(reason(err)));
+                        }
+                    );
+                });
+            }
+
+            return decode(out);
+        };
+    }
+
+    function build(node) {
+        if (node === null || typeof node !== 'object') return node;
+
+        if (Array.isArray(node)) {
+            var list = [];
+            for (var i = 0; i < node.length; i++) list.push(build(node[i]));
+            return list;
+        }
+
+        var keys = Object.keys(node);
+        if (keys.length === 1 && keys[0] === '__fn__' && typeof node.__fn__ === 'string') return wrap(node.__fn__);
+
+        var out = {};
+        for (var j = 0; j < keys.length; j++) out[keys[j]] = build(node[keys[j]]);
+        return out;
+    }
+
+    var data = decode(transfer) || {};
+    var dataKeys = Object.keys(data);
+    for (var d = 0; d < dataKeys.length; d++) globalThis[dataKeys[d]] = data[dataKeys[d]];
+
+    var bridge = build(decode(shape) || {});
+    var bridgeKeys = Object.keys(bridge);
+    for (var b = 0; b < bridgeKeys.length; b++) globalThis[bridgeKeys[b]] = bridge[bridgeKeys[b]];
+})(__transfer__, __shape__, __invoke__);
+
+delete globalThis.__transfer__;
+delete globalThis.__shape__;
+delete globalThis.__invoke__;
+`;
+const SANDBOX_EXPORT = `
+(function () {
+    var out = {};
+    var keys = Object.keys(globalThis);
+
+    for (var i = 0; i < keys.length; i++) {
+        try {
+            var json = JSON.stringify(globalThis[keys[i]]);
+            if (json === undefined) continue;
+            out[keys[i]] = JSON.parse(json);
+        } catch (err) {
+            // not representable as plain data - drop this binding
+        }
+    }
+
+    return JSON.stringify(out);
+})()
+`;
+class SandboxedScriptExecutor {
+    execute(script, options = {}) {
+        const rejected = this.rejectHostCallables(options);
+        if (rejected)
+            return rejected;
+        const blank = this.blankScriptResult(script, options);
+        if (blank)
+            return blank;
+        let prepared;
+        try {
+            prepared = this.prepare(options);
+        }
+        catch (err) {
+            return { ok: false, value: undefined, error: this.reason(err), context: this.plainContext(options) };
+        }
+        try {
+            const value = (0, vm_1.runInContext)(script, prepared.ctx, {
+                timeout: prepared.timeoutMs,
+                breakOnSigint: true,
+                displayErrors: false,
+            });
+            return { ok: true, value: this.toPlain(value), context: this.exportContext(prepared) };
+        }
+        catch (err) {
+            return { ok: false, value: undefined, error: this.reason(err), context: this.exportContext(prepared) };
+        }
+    }
+    async executeAsync(script, options = {}) {
+        const rejected = this.rejectHostCallables(options);
+        if (rejected)
+            return rejected;
+        const blank = this.blankScriptResult(script, options);
+        if (blank)
+            return blank;
+        let prepared;
+        try {
+            prepared = this.prepare(options);
+        }
+        catch (err) {
+            return { ok: false, value: undefined, error: this.reason(err), context: this.plainContext(options) };
+        }
+        let value;
+        try {
+            value = (0, vm_1.runInContext)(script, prepared.ctx, {
+                timeout: prepared.timeoutMs,
+                breakOnSigint: true,
+                displayErrors: false,
+            });
+        }
+        catch (err) {
+            return { ok: false, value: undefined, error: this.reason(err), context: this.exportContext(prepared) };
+        }
+        if (value && typeof value.then === 'function') {
+            try {
+                value = await value;
+            }
+            catch (err) {
+                return { ok: false, value: undefined, error: this.reason(err), context: this.exportContext(prepared) };
+            }
+        }
+        return { ok: true, value: this.toPlain(value), context: this.exportContext(prepared) };
+    }
+    invokeMethod(target, method, args = []) {
+        if (target === null || target === undefined)
+            throw new operation_exception_1.OperationException('sandbox bridge: target is not available');
+        if (typeof method !== 'string' || !method.trim())
+            throw new operation_exception_1.OperationException('sandbox bridge: a method name is required');
+        if (method.startsWith('_') || SandboxedScriptExecutor.DENIED_MEMBERS.includes(method))
+            throw new operation_exception_1.OperationException(`sandbox bridge: "${method}" is not callable from a script`);
+        if (!this.isDeclaredMember(target, method))
+            throw new operation_exception_1.OperationException(`sandbox bridge: "${method}" is not exposed to scripts`);
+        const member = target[method];
+        if (typeof member !== 'function')
+            throw new operation_exception_1.OperationException(`sandbox bridge: "${method}" is not callable from a script`);
+        return member.apply(target, Array.isArray(args) ? args : []);
+    }
+    writeBack(target, source) {
+        if (!target || typeof target !== 'object')
+            return;
+        if (!source || typeof source !== 'object')
+            return;
+        if (Array.isArray(target) && Array.isArray(source)) {
+            target.length = 0;
+            for (const entry of source)
+                target.push(entry);
+            return;
+        }
+        if (Array.isArray(target) || Array.isArray(source))
+            return;
+        for (const key of Object.keys(target)) {
+            if (!Object.prototype.hasOwnProperty.call(source, key))
+                delete target[key];
+        }
+        for (const key of Object.keys(source))
+            target[key] = source[key];
+    }
+    rejectHostCallables(options) {
+        const found = this.findHostCallable(options.context ?? {}, 'context', 0, new WeakSet());
+        if (!found)
+            return undefined;
+        return {
+            ok: false,
+            value: undefined,
+            error: `sandbox: host function at "${found}" cannot be exposed through \`context\` — declare it in \`bridge\` instead (U-S15)`,
+            context: {},
+        };
+    }
+    findHostCallable(node, path, depth, seen) {
+        if (typeof node === 'function')
+            return path;
+        if (!node || typeof node !== 'object')
+            return undefined;
+        if (depth >= SandboxedScriptExecutor.MAX_CLONE_DEPTH || seen.has(node))
+            return undefined;
+        seen.add(node);
+        try {
+            for (const key of Object.keys(node)) {
+                let member;
+                try {
+                    member = node[key];
+                }
+                catch {
+                    continue;
+                }
+                const found = this.findHostCallable(member, `${path}.${key}`, depth + 1, seen);
+                if (found)
+                    return found;
+            }
+            return undefined;
+        }
+        finally {
+            seen.delete(node);
+        }
+    }
+    blankScriptResult(script, options) {
+        if (script && script.trim())
+            return undefined;
+        return { ok: true, value: undefined, context: this.plainContext(options) };
+    }
+    plainContext(options) {
+        return this.toPlain(options.context ?? {}) ?? {};
+    }
+    prepare(options) {
+        const timeoutMs = options.timeoutMs ?? 1000;
+        const snapshot = this.plainContext(options);
+        const registry = new Map();
+        const bridge = options.bridge ?? {};
+        const transfer = JSON.stringify(snapshot);
+        const shape = JSON.stringify(this.describeBridge(bridge, registry, 'b', 0, new WeakSet()) ?? {});
+        const sandbox = {
+            __transfer__: transfer,
+            __shape__: shape,
+            __invoke__: (id, argsJson) => this.invokeBridge(registry, id, argsJson),
+        };
+        const ctx = (0, vm_1.createContext)(sandbox);
+        (0, vm_1.runInContext)(SANDBOX_BOOTSTRAP, ctx, { timeout: timeoutMs, breakOnSigint: true, displayErrors: false });
+        return { ctx, snapshot, bridgeKeys: Object.keys(bridge), timeoutMs };
+    }
+    describeBridge(node, registry, path, depth, seen) {
+        if (typeof node === 'function') {
+            registry.set(path, node);
+            return { __fn__: path };
+        }
+        if (node === null || typeof node !== 'object')
+            return this.toPlain(node);
+        if (depth >= SandboxedScriptExecutor.MAX_BRIDGE_DEPTH || seen.has(node))
+            return {};
+        seen.add(node);
+        try {
+            if (Array.isArray(node))
+                return node.map((entry, index) => this.describeBridge(entry, registry, `${path}.${index}`, depth + 1, seen));
+            const out = {};
+            for (const key of Object.keys(node)) {
+                let member;
+                try {
+                    member = node[key];
+                }
+                catch {
+                    continue;
+                }
+                const described = this.describeBridge(member, registry, `${path}.${key}`, depth + 1, seen);
+                if (described !== undefined)
+                    out[key] = described;
+            }
+            return out;
+        }
+        finally {
+            seen.delete(node);
+        }
+    }
+    invokeBridge(registry, id, argsJson) {
+        const hostFn = registry.get(id);
+        if (!hostFn)
+            throw new operation_exception_1.OperationException('sandbox bridge: unknown binding');
+        const args = this.decodeArgs(argsJson);
+        const out = hostFn(...args);
+        if (out && typeof out.then === 'function')
+            return Promise.resolve(out).then((value) => this.encode(value));
+        return this.encode(out);
+    }
+    decodeArgs(argsJson) {
+        if (!argsJson)
+            return [];
+        const args = JSON.parse(argsJson, (_key, value) => typeof value === 'string' && SandboxedScriptExecutor.ISO_TIMESTAMP.test(value) ? new Date(value) : value);
+        return Array.isArray(args) ? args : [];
+    }
+    encode(value) {
+        const plain = this.toPlain(value);
+        if (plain === undefined)
+            return undefined;
+        return JSON.stringify(plain);
+    }
+    exportContext(prepared) {
+        try {
+            const exported = (0, vm_1.runInContext)(SANDBOX_EXPORT, prepared.ctx, {
+                timeout: prepared.timeoutMs,
+                breakOnSigint: true,
+                displayErrors: false,
+            });
+            const parsed = JSON.parse(exported);
+            for (const key of prepared.bridgeKeys)
+                delete parsed[key];
+            return parsed;
+        }
+        catch {
+            return prepared.snapshot;
+        }
+    }
+    toPlain(value, seen = new WeakSet(), depth = 0) {
+        if (value === null)
+            return null;
+        const type = typeof value;
+        if (type === 'string' || type === 'number' || type === 'boolean')
+            return value;
+        if (type === 'bigint')
+            return value.toString();
+        if (type === 'undefined' || type === 'function' || type === 'symbol')
+            return undefined;
+        if (value instanceof Date)
+            return isNaN(value.getTime()) ? null : value.toISOString();
+        if (depth >= SandboxedScriptExecutor.MAX_CLONE_DEPTH || seen.has(value))
+            return undefined;
+        seen.add(value);
+        try {
+            if (Array.isArray(value)) {
+                const list = value.map((entry) => this.toPlain(entry, seen, depth + 1));
+                return list.map((entry) => (entry === undefined ? null : entry));
+            }
+            const out = {};
+            for (const key of Object.keys(value)) {
+                let member;
+                try {
+                    member = value[key];
+                }
+                catch {
+                    continue;
+                }
+                const converted = this.toPlain(member, seen, depth + 1);
+                if (converted !== undefined)
+                    out[key] = converted;
+            }
+            return out;
+        }
+        finally {
+            seen.delete(value);
+        }
+    }
+    isDeclaredMember(target, method) {
+        const builtins = [Object.prototype, Function.prototype, Array.prototype];
+        if (Object.prototype.hasOwnProperty.call(target, method))
+            return true;
+        let node = Object.getPrototypeOf(target);
+        while (node && !builtins.includes(node)) {
+            if (Object.prototype.hasOwnProperty.call(node, method))
+                return true;
+            node = Object.getPrototypeOf(node);
+        }
+        return false;
+    }
+    reason(err) {
+        try {
+            if (err && err.message)
+                return String(err.message);
+            return String(err);
+        }
+        catch {
+            return 'sandboxed script failure';
+        }
+    }
+}
+exports.SandboxedScriptExecutor = SandboxedScriptExecutor;
+SandboxedScriptExecutor.DENIED_MEMBERS = [
+    'constructor',
+    'prototype',
+    '__proto__',
+    '__defineGetter__',
+    '__defineSetter__',
+    '__lookupGetter__',
+    '__lookupSetter__',
+    'apply',
+    'bind',
+    'call',
+    'then',
+];
+SandboxedScriptExecutor.ISO_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$/;
+SandboxedScriptExecutor.MAX_CLONE_DEPTH = 12;
+SandboxedScriptExecutor.MAX_BRIDGE_DEPTH = 4;
+//# sourceMappingURL=sandboxed.script.executor.js.map

package/dist/system/libraries/sandboxed.script.executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxed.script.executor.js","sourceRoot":"","sources":["../../../src/system/libraries/sandboxed.script.executor.ts"],"names":[],"mappings":";;;AAAA,2BAAiD;AACjD,qFAAiF;AAuEjF,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoFzB,CAAC;AASF,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;CAiBtB,CAAC;AA6BF,MAAa,uBAAuB;IAmChC,OAAO,CAAC,MAAc,EAAE,UAAmC,EAAE;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACtD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QAExB,IAAI,QAAyB,CAAC;QAC9B,IAAI,CAAC;YACD,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACzG,CAAC;QAED,IAAI,CAAC;YACD,MAAM,KAAK,GAAG,IAAA,iBAAY,EAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE;gBAC7C,OAAO,EAAE,QAAQ,CAAC,SAAS;gBAC3B,aAAa,EAAE,IAAI;gBACnB,aAAa,EAAE,KAAK;aACvB,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3F,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3G,CAAC;IACL,CAAC;IAgBD,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,UAAmC,EAAE;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACtD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QAExB,IAAI,QAAyB,CAAC;QAC9B,IAAI,CAAC;YACD,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACzG,CAAC;QAED,IAAI,KAAU,CAAC;QACf,IAAI,CAAC;YACD,KAAK,GAAG,IAAA,iBAAY,EAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE;gBACvC,OAAO,EAAE,QAAQ,CAAC,SAAS;gBAC3B,aAAa,EAAE,IAAI;gBACnB,aAAa,EAAE,KAAK;aACvB,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3G,CAAC;QAED,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC5C,IAAI,CAAC;gBACD,KAAK,GAAG,MAAM,KAAK,CAAC;YACxB,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3G,CAAC;QACL,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC3F,CAAC;IAqBD,YAAY,CAAC,MAAW,EAAE,MAAc,EAAE,OAAc,EAAE;QACtD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,wCAAkB,CAAC,yCAAyC,CAAC,CAAC;QAErH,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,wCAAkB,CAAC,2CAA2C,CAAC,CAAC;QAE5H,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,uBAAuB,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;YACjF,MAAM,IAAI,wCAAkB,CAAC,oBAAoB,MAAM,iCAAiC,CAAC,CAAC;QAE9F,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC;YAAE,MAAM,IAAI,wCAAkB,CAAC,oBAAoB,MAAM,6BAA6B,CAAC,CAAC;QAElI,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,OAAO,MAAM,KAAK,UAAU;YAAE,MAAM,IAAI,wCAAkB,CAAC,oBAAoB,MAAM,iCAAiC,CAAC,CAAC;QAE5H,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IAaD,SAAS,CAAC,MAAW,EAAE,MAAW;QAC9B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO;QAClD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO;QAElD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;YAClB,KAAK,MAAM,KAAK,IAAI,MAAM;gBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/C,OAAO;QACX,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO;QAE3D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/E,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACrE,CAAC;IAaO,mBAAmB,CAAC,OAAgC;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAE7B,OAAO;YACH,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,8BAA8B,KAAK,oFAAoF;YAC9H,OAAO,EAAE,EAAE;SACd,CAAC;IACN,CAAC;IAMO,gBAAgB,CAAC,IAAS,EAAE,IAAY,EAAE,KAAa,EAAE,IAAqB;QAClF,IAAI,OAAO,IAAI,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;QAC5C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACxD,IAAI,KAAK,IAAI,uBAAuB,CAAC,eAAe,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAEzF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEf,IAAI,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,IAAI,MAAW,CAAC;gBAChB,IAAI,CAAC;oBACD,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;gBACvB,CAAC;gBAAC,MAAM,CAAC;oBACL,SAAS;gBACb,CAAC;gBAED,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;gBAC/E,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;YAC5B,CAAC;YAED,OAAO,SAAS,CAAC;QACrB,CAAC;gBAAS,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;IACL,CAAC;IAMO,iBAAiB,CAAC,MAAc,EAAE,OAAgC;QACtE,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE;YAAE,OAAO,SAAS,CAAC;QAE9C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/E,CAAC;IAOO,YAAY,CAAC,OAAgC;QACjD,OAAQ,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAA6B,IAAI,EAAE,CAAC;IAClF,CAAC;IAOO,OAAO,CAAC,OAAgC;QAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmC,CAAC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QAEpC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAEjG,MAAM,OAAO,GAA4B;YACrC,YAAY,EAAE,QAAQ;YACtB,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,CAAC,EAAU,EAAE,QAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,EAAE,QAAQ,CAAC;SAC1F,CAAC;QAEF,MAAM,GAAG,GAAG,IAAA,kBAAa,EAAC,OAAO,CAAC,CAAC;QACnC,IAAA,iBAAY,EAAC,iBAAiB,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;QAExG,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC;IACzE,CAAC;IAQO,cAAc,CAAC,IAAS,EAAE,QAA8C,EAAE,IAAY,EAAE,KAAa,EAAE,IAAqB;QAChI,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;YAC7B,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAA+B,CAAC,CAAC;YACpD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QAED,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzE,IAAI,KAAK,IAAI,uBAAuB,CAAC,gBAAgB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QAEnF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEf,IAAI,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YAEtI,MAAM,GAAG,GAAwB,EAAE,CAAC;YACpC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,IAAI,MAAW,CAAC;gBAChB,IAAI,CAAC;oBACD,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;gBACvB,CAAC;gBAAC,MAAM,CAAC;oBACL,SAAS;gBACb,CAAC;gBAED,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;gBAC3F,IAAI,SAAS,KAAK,SAAS;oBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;YACtD,CAAC;YAED,OAAO,GAAG,CAAC;QACf,CAAC;gBAAS,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;IACL,CAAC;IAQO,YAAY,CAAC,QAA8C,EAAE,EAAU,EAAE,QAAgB;QAC7F,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,wCAAkB,CAAC,iCAAiC,CAAC,CAAC;QAE7E,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QAE5B,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAE3G,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAQO,UAAU,CAAC,QAAgB;QAC/B,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QAEzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC9C,OAAO,KAAK,KAAK,QAAQ,IAAI,uBAAuB,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAC3G,CAAC;QAEF,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,CAAC;IAMO,MAAM,CAAC,KAAU;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAE1C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAOO,aAAa,CAAC,QAAyB;QAC3C,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,IAAA,iBAAY,EAAC,cAAc,EAAE,QAAQ,CAAC,GAAG,EAAE;gBACxD,OAAO,EAAE,QAAQ,CAAC,SAAS;gBAC3B,aAAa,EAAE,IAAI;gBACnB,aAAa,EAAE,KAAK;aACvB,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA4B,CAAC;YAC/D,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,UAAU;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;YAE1D,OAAO,MAAM,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,QAAQ,CAAC,QAAQ,CAAC;QAC7B,CAAC;IACL,CAAC;IAQO,OAAO,CAAC,KAAU,EAAE,OAAwB,IAAI,OAAO,EAAE,EAAE,KAAK,GAAG,CAAC;QACxE,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAEhC,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC;QAC1B,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC/E,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/C,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACvF,IAAI,KAAK,YAAY,IAAI;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACtF,IAAI,KAAK,IAAI,uBAAuB,CAAC,eAAe,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAE1F,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAEhB,IAAI,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;gBACxE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACrE,CAAC;YAED,MAAM,GAAG,GAAwB,EAAE,CAAC;YACpC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnC,IAAI,MAAW,CAAC;gBAChB,IAAI,CAAC;oBACD,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACL,SAAS;gBACb,CAAC;gBAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBACxD,IAAI,SAAS,KAAK,SAAS;oBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;YACtD,CAAC;YAED,OAAO,GAAG,CAAC;QACf,CAAC;gBAAS,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACL,CAAC;IAOO,gBAAgB,CAAC,MAAW,EAAE,MAAc;QAChD,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAEzE,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAEtE,IAAI,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACzC,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpE,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC;IAMO,MAAM,CAAC,GAAQ;QACnB,IAAI,CAAC;YACD,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,0BAA0B,CAAC;QACtC,CAAC;IACL,CAAC;;AArcL,0DAscC;AApc2B,sCAAc,GAAG;IACrC,aAAa;IACb,WAAW;IACX,WAAW;IACX,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;CACT,CAAC;AAGsB,qCAAa,GAAG,kEAAkE,CAAC;AAGnF,uCAAe,GAAG,EAAE,CAAC;AAGrB,wCAAgB,GAAG,CAAC,CAAC"}

package/dist/system/libraries/security.rule.evaluator.d.ts

@@ -1,5 +1,6 @@
 export declare class SecurityRuleEvaluator {
     private data;
+    private readonly executor;
     constructor(data: any);
     process(rule: any): Promise<boolean>;
     evaluateCondition(condition: string): Promise<boolean>;

package/dist/system/libraries/security.rule.evaluator.js

@@ -2,8 +2,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SecurityRuleEvaluator = void 0;
 const auth_1 = require("../../common/libraries/auth");
+const sandboxed_script_executor_1 = require("./sandboxed.script.executor");
 class SecurityRuleEvaluator {
     constructor(data) {
+        this.executor = new sandboxed_script_executor_1.SandboxedScriptExecutor();
         this.data = data;
     }
     async process(rule) {
@@ -15,11 +17,22 @@ class SecurityRuleEvaluator {
     async evaluateCondition(condition) {
         if (!condition)
             return true;
-        const data = this.data;
-        const user = auth_1.Auth.user();
-        let answer = true;
-        eval(condition);
-        return answer;
+        const strictDeny = process.env.SECURITY_RULE_STRICT_DENY === 'true';
+        const initialAnswer = !strictDeny;
+        const result = this.executor.execute(condition, {
+            timeoutMs: 1000,
+            context: {
+                data: this.data,
+                user: auth_1.Auth.user(),
+                answer: initialAnswer,
+            },
+        });
+        if (!result.ok) {
+            global.console.error(`SecurityRuleEvaluator: condition eval failed (fail-closed): ${result.error}`);
+            return false;
+        }
+        const answer = result.context.answer;
+        return typeof answer === 'boolean' ? answer : initialAnswer;
     }
 }
 exports.SecurityRuleEvaluator = SecurityRuleEvaluator;