@spinajs/rbac-http 1.2.125 → 1.2.127
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/decorators.d.ts +2 -1
- package/lib/decorators.js +18 -3
- package/lib/decorators.js.map +1 -1
- package/lib/interfaces.d.ts +3 -3
- package/lib/policies.d.ts +6 -2
- package/lib/policies.js +24 -4
- package/lib/policies.js.map +1 -1
- package/package.json +11 -10
package/lib/decorators.d.ts
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
|
-
import { PermissionType } from './interfaces';
|
|
1
|
+
import { IRbacDescriptor, PermissionType } from './interfaces';
|
|
2
2
|
export declare const ACL_CONTROLLER_DESCRIPTOR: unique symbol;
|
|
3
|
+
export declare function setRbacMetadata(target: any, callback: (meta: IRbacDescriptor) => void): void;
|
|
3
4
|
/**
|
|
4
5
|
* Assign resource for controller
|
|
5
6
|
*
|
package/lib/decorators.js
CHANGED
|
@@ -1,9 +1,24 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.FromUser = exports.Permission = exports.Resource = exports.ACL_CONTROLLER_DESCRIPTOR = void 0;
|
|
3
|
+
exports.FromUser = exports.Permission = exports.Resource = exports.setRbacMetadata = exports.ACL_CONTROLLER_DESCRIPTOR = void 0;
|
|
4
4
|
const http_1 = require("@spinajs/http");
|
|
5
5
|
const policies_1 = require("./policies");
|
|
6
6
|
exports.ACL_CONTROLLER_DESCRIPTOR = Symbol('ACL_CONTROLLER_DESCRIPTOR_SYMBOL');
|
|
7
|
+
function setRbacMetadata(target, callback) {
|
|
8
|
+
let metadata = Reflect.getMetadata(exports.ACL_CONTROLLER_DESCRIPTOR, target.prototype || target);
|
|
9
|
+
if (!metadata) {
|
|
10
|
+
metadata = {
|
|
11
|
+
Resource: '',
|
|
12
|
+
Routes: new Map(),
|
|
13
|
+
Permission: 'readOwn',
|
|
14
|
+
};
|
|
15
|
+
Reflect.defineMetadata(exports.ACL_CONTROLLER_DESCRIPTOR, metadata, target.prototype || target);
|
|
16
|
+
}
|
|
17
|
+
if (callback) {
|
|
18
|
+
callback(metadata);
|
|
19
|
+
}
|
|
20
|
+
}
|
|
21
|
+
exports.setRbacMetadata = setRbacMetadata;
|
|
7
22
|
function descriptor(callback) {
|
|
8
23
|
return (target, propertyKey, indexOrDescriptor) => {
|
|
9
24
|
let metadata = Reflect.getMetadata(exports.ACL_CONTROLLER_DESCRIPTOR, target.prototype || target);
|
|
@@ -28,7 +43,7 @@ function descriptor(callback) {
|
|
|
28
43
|
*/
|
|
29
44
|
function Resource(resource, permission = 'readOwn') {
|
|
30
45
|
return descriptor((metadata, target) => {
|
|
31
|
-
(0, http_1.Policy)(policies_1.
|
|
46
|
+
(0, http_1.Policy)(policies_1.RbacPolicy)(target, null, null);
|
|
32
47
|
metadata.Resource = resource;
|
|
33
48
|
metadata.Permission = permission;
|
|
34
49
|
});
|
|
@@ -54,7 +69,7 @@ function Permission(permission = 'readOwn') {
|
|
|
54
69
|
}
|
|
55
70
|
metadata.Routes.set(propertyKey, route);
|
|
56
71
|
}
|
|
57
|
-
(0, http_1.Policy)(policies_1.
|
|
72
|
+
(0, http_1.Policy)(policies_1.RbacPolicy)(target, propertyKey, null);
|
|
58
73
|
});
|
|
59
74
|
}
|
|
60
75
|
exports.Permission = Permission;
|
package/lib/decorators.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"decorators.js","sourceRoot":"","sources":["../src/decorators.ts"],"names":[],"mappings":";;;AACA,wCAAyD;AACzD,
|
|
1
|
+
{"version":3,"file":"decorators.js","sourceRoot":"","sources":["../src/decorators.ts"],"names":[],"mappings":";;;AACA,wCAAyD;AACzD,yCAAwC;AAE3B,QAAA,yBAAyB,GAAG,MAAM,CAAC,kCAAkC,CAAC,CAAC;AAEpF,SAAgB,eAAe,CAAC,MAAW,EAAE,QAAyC;IACpF,IAAI,QAAQ,GAAoB,OAAO,CAAC,WAAW,CAAC,iCAAyB,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;IAC3G,IAAI,CAAC,QAAQ,EAAE;QACb,QAAQ,GAAG;YACT,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,IAAI,GAAG,EAA0C;YACzD,UAAU,EAAE,SAAS;SACtB,CAAC;QAEF,OAAO,CAAC,cAAc,CAAC,iCAAyB,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;KACzF;IAED,IAAI,QAAQ,EAAE;QACZ,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACpB;AACH,CAAC;AAfD,0CAeC;AAED,SAAS,UAAU,CAAC,QAA0I;IAC5J,OAAO,CAAC,MAAW,EAAE,WAA4B,EAAE,iBAA8C,EAAE,EAAE;QACnG,IAAI,QAAQ,GAAoB,OAAO,CAAC,WAAW,CAAC,iCAAyB,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;QAC3G,IAAI,CAAC,QAAQ,EAAE;YACb,QAAQ,GAAG;gBACT,QAAQ,EAAE,EAAE;gBACZ,MAAM,EAAE,IAAI,GAAG,EAA0C;gBACzD,UAAU,EAAE,SAAS;aACtB,CAAC;YAEF,OAAO,CAAC,cAAc,CAAC,iCAAyB,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;SACzF;QAED,IAAI,QAAQ,EAAE;YACZ,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;SAC5D;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,QAAQ,CAAC,QAAgB,EAAE,aAA6B,SAAS;IAC/E,OAAO,UAAU,CAAC,CAAC,QAAyB,EAAE,MAAW,EAAE,EAAE;QAC3D,IAAA,aAAM,EAAC,qBAAU,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAEvC,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC7B,QAAQ,CAAC,UAAU,GAAG,UAAU,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAPD,4BAOC;AAED;;;;;GAKG;AACH,SAAgB,UAAU,CAAC,aAA6B,SAAS;IAC/D,OAAO,UAAU,CAAC,CAAC,QAAyB,EAAE,MAAW,EAAE,WAAmB,EAAE,EAAE;QAChF,IAAI,KAAK,GAAmC,IAAI,CAAC;QAEjD,IAAI,WAAW,EAAE;YACf,IAAI,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE;gBACpC,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;aAC1C;iBAAM;gBACL,KAAK,GAAG;oBACN,UAAU,EAAE,UAAU;iBACvB,CAAC;aACH;YAED,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;SACzC;QAED,IAAA,aAAM,EAAC,qBAAU,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC;AAlBD,gCAkBC;AAED,SAAgB,QAAQ;IACtB,OAAO,IAAA,YAAK,EAAC,IAAA,gBAAS,EAAC,SAAS,CAAC,CAAC,CAAC;AACrC,CAAC;AAFD,4BAEC"}
|
package/lib/interfaces.d.ts
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
export declare type PermissionType = 'readAny' | 'readOwn' | 'updateAny' | 'updateOwn' | 'deleteAny' | 'deleteOwn' | 'createAny' | 'createOwn';
|
|
2
|
-
export interface
|
|
2
|
+
export interface IRbacDescriptor {
|
|
3
3
|
/**
|
|
4
4
|
* Resource name
|
|
5
5
|
*/
|
|
@@ -13,9 +13,9 @@ export interface IAclDescriptor {
|
|
|
13
13
|
/**
|
|
14
14
|
* Per routes permissions
|
|
15
15
|
*/
|
|
16
|
-
Routes: Map<string,
|
|
16
|
+
Routes: Map<string, IRbacRoutePermissionDescriptor>;
|
|
17
17
|
}
|
|
18
|
-
export interface
|
|
18
|
+
export interface IRbacRoutePermissionDescriptor {
|
|
19
19
|
/**
|
|
20
20
|
* controller route permission. It overrides acl descriptor options
|
|
21
21
|
*/
|
package/lib/policies.d.ts
CHANGED
|
@@ -1,9 +1,13 @@
|
|
|
1
|
-
import { AccessControl } from '
|
|
1
|
+
import { AccessControl, Permission } from 'accesscontrol';
|
|
2
2
|
import { BasePolicy, IController, IRoute } from '@spinajs/http';
|
|
3
3
|
import * as express from 'express';
|
|
4
|
-
|
|
4
|
+
import { User } from '@spinajs/rbac';
|
|
5
|
+
export declare class RbacPolicy extends BasePolicy {
|
|
5
6
|
protected Ac: AccessControl;
|
|
6
7
|
constructor();
|
|
7
8
|
isEnabled(_action: IRoute, _instance: IController): boolean;
|
|
8
9
|
execute(req: express.Request, action: IRoute, instance: IController): Promise<void>;
|
|
9
10
|
}
|
|
11
|
+
export declare function checkRbacPermission(role: string | string[], resource: string, permission: string): Permission;
|
|
12
|
+
export declare function checkUserPermission(user: User, resource: string, permission: string): Permission;
|
|
13
|
+
export declare function checkRoutePermission(req: express.Request, resource: string, permission: string): Permission;
|
package/lib/policies.js
CHANGED
|
@@ -1,11 +1,11 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.
|
|
3
|
+
exports.checkRoutePermission = exports.checkUserPermission = exports.checkRbacPermission = exports.RbacPolicy = void 0;
|
|
4
4
|
const http_1 = require("@spinajs/http");
|
|
5
5
|
const exceptions_1 = require("@spinajs/exceptions");
|
|
6
6
|
const decorators_1 = require("./decorators");
|
|
7
7
|
const di_1 = require("@spinajs/di");
|
|
8
|
-
class
|
|
8
|
+
class RbacPolicy extends http_1.BasePolicy {
|
|
9
9
|
constructor() {
|
|
10
10
|
super();
|
|
11
11
|
this.Ac = di_1.DI.get('AccessControl');
|
|
@@ -28,10 +28,30 @@ class AclPolicy extends http_1.BasePolicy {
|
|
|
28
28
|
if (!req.User) {
|
|
29
29
|
throw new exceptions_1.AuthenticationFailed();
|
|
30
30
|
}
|
|
31
|
-
if (!
|
|
31
|
+
if (!checkRoutePermission(req, descriptor.Resource, permission).granted) {
|
|
32
32
|
throw new exceptions_1.Forbidden(`role(s) ${req.User.Role} does not have permission ${permission} for resource ${descriptor.Resource}`);
|
|
33
33
|
}
|
|
34
34
|
}
|
|
35
35
|
}
|
|
36
|
-
exports.
|
|
36
|
+
exports.RbacPolicy = RbacPolicy;
|
|
37
|
+
function checkRbacPermission(role, resource, permission) {
|
|
38
|
+
const ac = di_1.DI.get('AccessControl');
|
|
39
|
+
return ac.can(role)[permission](resource);
|
|
40
|
+
}
|
|
41
|
+
exports.checkRbacPermission = checkRbacPermission;
|
|
42
|
+
function checkUserPermission(user, resource, permission) {
|
|
43
|
+
const ac = di_1.DI.get('AccessControl');
|
|
44
|
+
if (!user) {
|
|
45
|
+
return null;
|
|
46
|
+
}
|
|
47
|
+
return ac.can(user.Role.split(','))[permission](resource);
|
|
48
|
+
}
|
|
49
|
+
exports.checkUserPermission = checkUserPermission;
|
|
50
|
+
function checkRoutePermission(req, resource, permission) {
|
|
51
|
+
if (!req.User) {
|
|
52
|
+
return null;
|
|
53
|
+
}
|
|
54
|
+
return checkUserPermission(req.User, resource, permission);
|
|
55
|
+
}
|
|
56
|
+
exports.checkRoutePermission = checkRoutePermission;
|
|
37
57
|
//# sourceMappingURL=policies.js.map
|
package/lib/policies.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"policies.js","sourceRoot":"","sources":["../src/policies.ts"],"names":[],"mappings":";;;AACA,wCAAgE;AAEhE,oDAAsE;AACtE,6CAAyD;AAEzD,oCAAiC;
|
|
1
|
+
{"version":3,"file":"policies.js","sourceRoot":"","sources":["../src/policies.ts"],"names":[],"mappings":";;;AACA,wCAAgE;AAEhE,oDAAsE;AACtE,6CAAyD;AAEzD,oCAAiC;AAGjC,MAAa,UAAW,SAAQ,iBAAU;IAGxC;QACE,KAAK,EAAE,CAAC;QAER,IAAI,CAAC,EAAE,GAAG,OAAE,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpC,CAAC;IAEM,SAAS,CAAC,OAAe,EAAE,SAAsB;QACtD,0BAA0B;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,GAAoB,EAAE,MAAc,EAAE,QAAqB;;QAC9E,MAAM,UAAU,GAAoB,OAAO,CAAC,WAAW,CAAC,sCAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7F,IAAI,UAAU,GAAG,MAAA,UAAU,CAAC,UAAU,mCAAI,EAAE,CAAC;QAE7C,wCAAwC;QACxC,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;YACxC,UAAU,GAAG,MAAA,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,mCAAI,EAAE,CAAC;SACpE;QAED,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE;YACzC,MAAM,IAAI,sBAAS,CAAC,2CAA2C,CAAC,CAAC;SAClE;QAED,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;YACb,MAAM,IAAI,iCAAoB,EAAE,CAAC;SAClC;QAED,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,OAAO,EAAE;YACvE,MAAM,IAAI,sBAAS,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,IAAI,6BAA6B,UAAU,iBAAiB,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;SAC5H;IACH,CAAC;CACF;AAnCD,gCAmCC;AAED,SAAgB,mBAAmB,CAAC,IAAuB,EAAE,QAAgB,EAAE,UAAkB;IAC/F,MAAM,EAAE,GAAG,OAAE,CAAC,GAAG,CAAgB,eAAe,CAAC,CAAC;IAClD,OAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;AACrD,CAAC;AAHD,kDAGC;AAED,SAAgB,mBAAmB,CAAC,IAAU,EAAE,QAAgB,EAAE,UAAkB;IAClF,MAAM,EAAE,GAAG,OAAE,CAAC,GAAG,CAAgB,eAAe,CAAC,CAAC;IAElD,IAAI,CAAC,IAAI,EAAE;QACT,OAAO,IAAI,CAAC;KACb;IAED,OAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;AACrE,CAAC;AARD,kDAQC;AAED,SAAgB,oBAAoB,CAAC,GAAoB,EAAE,QAAgB,EAAE,UAAkB;IAC7F,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QACb,OAAO,IAAI,CAAC;KACb;IAED,OAAO,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;AAC7D,CAAC;AAND,oDAMC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@spinajs/rbac-http",
|
|
3
|
-
"version": "1.2.
|
|
3
|
+
"version": "1.2.127",
|
|
4
4
|
"description": "HTTP API for user session & permissions",
|
|
5
5
|
"main": "lib/index.js",
|
|
6
6
|
"private": false,
|
|
@@ -38,17 +38,18 @@
|
|
|
38
38
|
},
|
|
39
39
|
"homepage": "https://github.com/spinajs/main#readme",
|
|
40
40
|
"dependencies": {
|
|
41
|
-
"@spinajs/configuration": "^1.2.
|
|
42
|
-
"@spinajs/di": "^1.2.
|
|
43
|
-
"@spinajs/exceptions": "^1.2.
|
|
44
|
-
"@spinajs/log": "^1.2.
|
|
45
|
-
"@spinajs/orm": "^1.2.
|
|
46
|
-
"@spinajs/rbac": "^1.2.
|
|
47
|
-
"@spinajs/reflection": "^1.2.
|
|
41
|
+
"@spinajs/configuration": "^1.2.127",
|
|
42
|
+
"@spinajs/di": "^1.2.127",
|
|
43
|
+
"@spinajs/exceptions": "^1.2.127",
|
|
44
|
+
"@spinajs/log": "^1.2.127",
|
|
45
|
+
"@spinajs/orm": "^1.2.127",
|
|
46
|
+
"@spinajs/rbac": "^1.2.127",
|
|
47
|
+
"@spinajs/reflection": "^1.2.127",
|
|
48
|
+
"accesscontrol": "^2.2.1",
|
|
48
49
|
"luxon": "^2.4.0"
|
|
49
50
|
},
|
|
50
51
|
"devDependencies": {
|
|
51
|
-
"@spinajs/orm-sqlite": "^1.2.
|
|
52
|
+
"@spinajs/orm-sqlite": "^1.2.127"
|
|
52
53
|
},
|
|
53
|
-
"gitHead": "
|
|
54
|
+
"gitHead": "53b022d0e70b7f2689ac984578b52afb0fd9e967"
|
|
54
55
|
}
|