@spinajs/rbac-http 2.0.476 → 2.0.478
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/cjs/decorators.d.ts +9 -0
- package/lib/cjs/decorators.d.ts.map +1 -1
- package/lib/cjs/decorators.js +21 -0
- package/lib/cjs/decorators.js.map +1 -1
- package/lib/cjs/interfaces.d.ts +50 -0
- package/lib/cjs/interfaces.d.ts.map +1 -1
- package/lib/cjs/interfaces.js.map +1 -1
- package/lib/cjs/middlewares.d.ts.map +1 -1
- package/lib/cjs/middlewares.js +12 -0
- package/lib/cjs/middlewares.js.map +1 -1
- package/lib/cjs/policies/RbacPolicy.d.ts.map +1 -1
- package/lib/cjs/policies/RbacPolicy.js +5 -2
- package/lib/cjs/policies/RbacPolicy.js.map +1 -1
- package/lib/mjs/decorators.d.ts +9 -0
- package/lib/mjs/decorators.d.ts.map +1 -1
- package/lib/mjs/decorators.js +21 -1
- package/lib/mjs/decorators.js.map +1 -1
- package/lib/mjs/interfaces.d.ts +50 -0
- package/lib/mjs/interfaces.d.ts.map +1 -1
- package/lib/mjs/interfaces.js.map +1 -1
- package/lib/mjs/middlewares.d.ts.map +1 -1
- package/lib/mjs/middlewares.js +12 -0
- package/lib/mjs/middlewares.js.map +1 -1
- package/lib/mjs/policies/RbacPolicy.d.ts.map +1 -1
- package/lib/mjs/policies/RbacPolicy.js +5 -2
- package/lib/mjs/policies/RbacPolicy.js.map +1 -1
- package/lib/tsconfig.cjs.tsbuildinfo +1 -1
- package/lib/tsconfig.mjs.tsbuildinfo +1 -1
- package/package.json +10 -10
package/lib/cjs/decorators.d.ts
CHANGED
|
@@ -20,6 +20,15 @@ export declare function Resource(resource: string, permission?: PermissionType[]
|
|
|
20
20
|
* @param permission - permission to set
|
|
21
21
|
*/
|
|
22
22
|
export declare function Permission(permission?: PermissionType[]): any;
|
|
23
|
+
/**
|
|
24
|
+
* Disables RbacModelPermissionMiddleware for controller action ( or whole controller when applied to class ).
|
|
25
|
+
*
|
|
26
|
+
* Use for actions that are assumed safe to execute - rbac permission
|
|
27
|
+
* constraints will NOT be injected into query builders for queries
|
|
28
|
+
* executed within the action. Route-level permission checks ( RbacPolicy )
|
|
29
|
+
* are NOT affected by this decorator.
|
|
30
|
+
*/
|
|
31
|
+
export declare function SkipModelPermission(): (target: any, propertyKey?: string | symbol, indexOrDescriptor?: number | PropertyDescriptor) => void;
|
|
23
32
|
/**
|
|
24
33
|
* Retrieves user from session if is logged in
|
|
25
34
|
*/
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"decorators.d.ts","sourceRoot":"","sources":["../../src/decorators.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAkC,MAAM,iBAAiB,CAAC;AAGlF,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"decorators.d.ts","sourceRoot":"","sources":["../../src/decorators.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAkC,MAAM,iBAAiB,CAAC;AAGlF,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG/C;;;GAGG;AACH,eAAO,MAAM,yBAAyB,eAAiD,CAAC;AAExF,wBAAgB,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,IAAI,QAerF;AAqBD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,GAAE,cAAc,EAAgB,OAKpF;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,UAAU,GAAE,cAAc,EAAgB,OAapE;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,0GAalC;AAED;;GAEG;AACH,wBAAgB,IAAI,0GAEnB;AAED;;GAEG;AACH,wBAAgB,WAAW,0GAE1B;AAED,wBAAgB,OAAO,0GAEtB"}
|
package/lib/cjs/decorators.js
CHANGED
|
@@ -4,6 +4,7 @@ exports.ACL_CONTROLLER_DESCRIPTOR = void 0;
|
|
|
4
4
|
exports.setRbacMetadata = setRbacMetadata;
|
|
5
5
|
exports.Resource = Resource;
|
|
6
6
|
exports.Permission = Permission;
|
|
7
|
+
exports.SkipModelPermission = SkipModelPermission;
|
|
7
8
|
exports.User = User;
|
|
8
9
|
exports.FromSession = FromSession;
|
|
9
10
|
exports.Session = Session;
|
|
@@ -75,6 +76,26 @@ function Permission(permission = ['readOwn']) {
|
|
|
75
76
|
(0, http_1.Policy)(RbacPolicy_js_1.RbacPolicy)(target, propertyKey, undefined);
|
|
76
77
|
});
|
|
77
78
|
}
|
|
79
|
+
/**
|
|
80
|
+
* Disables RbacModelPermissionMiddleware for controller action ( or whole controller when applied to class ).
|
|
81
|
+
*
|
|
82
|
+
* Use for actions that are assumed safe to execute - rbac permission
|
|
83
|
+
* constraints will NOT be injected into query builders for queries
|
|
84
|
+
* executed within the action. Route-level permission checks ( RbacPolicy )
|
|
85
|
+
* are NOT affected by this decorator.
|
|
86
|
+
*/
|
|
87
|
+
function SkipModelPermission() {
|
|
88
|
+
return (0, http_1.Middleware)(class extends http_1.RouteMiddleware {
|
|
89
|
+
isEnabled(_route, _controller) {
|
|
90
|
+
return true;
|
|
91
|
+
}
|
|
92
|
+
async onBefore(req, _res, _route, _controller) {
|
|
93
|
+
req.storage.SkipModelPermissionCheck = true;
|
|
94
|
+
}
|
|
95
|
+
async onResponse(_response, _route, _controller) { }
|
|
96
|
+
async onAfter(_req, _res, _route, _controller) { }
|
|
97
|
+
});
|
|
98
|
+
}
|
|
78
99
|
/**
|
|
79
100
|
* Retrieves user from session if is logged in
|
|
80
101
|
*/
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"decorators.js","sourceRoot":"","sources":["../../src/decorators.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"decorators.js","sourceRoot":"","sources":["../../src/decorators.ts"],"names":[],"mappings":";;;AAYA,0CAeC;AA2BD,4BAKC;AAQD,gCAaC;AAUD,kDAaC;AAKD,oBAEC;AAKD,kCAEC;AAED,0BAEC;AAxHD,wCAA0I;AAC1I,4DAAsD;AAItD;;;GAGG;AACU,QAAA,yBAAyB,GAAG,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;AAExF,SAAgB,eAAe,CAAC,MAAW,EAAE,QAAyC;IACpF,IAAI,QAAQ,GAAoB,OAAO,CAAC,WAAW,CAAC,iCAAyB,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;IAC3G,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG;YACT,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,IAAI,GAAG,EAA0C;YACzD,UAAU,EAAE,CAAC,SAAS,CAAC;SACxB,CAAC;QAEF,OAAO,CAAC,cAAc,CAAC,iCAAyB,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,QAA0I;IAC5J,OAAO,CAAC,MAAW,EAAE,WAA4B,EAAE,iBAA8C,EAAE,EAAE;QACnG,IAAI,QAAQ,GAAoB,OAAO,CAAC,WAAW,CAAC,iCAAyB,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;QAC3G,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG;gBACT,QAAQ,EAAE,EAAE;gBACZ,MAAM,EAAE,IAAI,GAAG,EAA0C;gBACzD,UAAU,EAAE,CAAC,SAAS,CAAC;aACxB,CAAC;YAEF,OAAO,CAAC,cAAc,CAAC,iCAAyB,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,QAAQ,CAAC,QAAgB,EAAE,aAA+B,CAAC,SAAS,CAAC;IACnF,OAAO,UAAU,CAAC,CAAC,QAAyB,EAAE,EAAE;QAC9C,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC7B,QAAQ,CAAC,UAAU,GAAG,UAAU,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAgB,UAAU,CAAC,aAA+B,CAAC,SAAS,CAAC;IACnE,OAAO,UAAU,CAAC,CAAC,QAAyB,EAAE,MAAW,EAAE,WAAmB,EAAE,EAAE;QAChF,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,MAAM,KAAK,GAAG;oBACZ,UAAU,EAAE,UAAU;iBACvB,CAAC;gBACF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,IAAA,aAAM,EAAC,0BAAU,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,mBAAmB;IACjC,OAAO,IAAA,iBAAU,EACf,KAAM,SAAQ,sBAAe;QACpB,SAAS,CAAC,MAAc,EAAE,WAAwB;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;QACM,KAAK,CAAC,QAAQ,CAAC,GAAoB,EAAE,IAAsB,EAAE,MAAc,EAAE,WAAwB;YACzG,GAAgB,CAAC,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;QAC5D,CAAC;QACM,KAAK,CAAC,UAAU,CAAC,SAAmB,EAAE,MAAc,EAAE,WAAwB,IAAkB,CAAC;QACjG,KAAK,CAAC,OAAO,CAAC,IAAqB,EAAE,IAAsB,EAAE,MAAc,EAAE,WAAwB,IAAkB,CAAC;KAChI,CACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,IAAI;IAClB,OAAO,IAAA,YAAK,EAAC,IAAA,gBAAS,EAAC,SAAS,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,SAAgB,WAAW;IACzB,OAAO,IAAA,YAAK,EAAC,IAAA,gBAAS,EAAC,YAAY,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,SAAgB,OAAO;IACrB,OAAO,IAAA,YAAK,EAAC,IAAA,gBAAS,EAAC,mBAAmB,CAAC,CAAC,CAAC;AAC/C,CAAC"}
|
package/lib/cjs/interfaces.d.ts
CHANGED
|
@@ -30,8 +30,41 @@ export type IGrantsMap = Record<string, Record<string, {
|
|
|
30
30
|
}>>;
|
|
31
31
|
/** Successful authentication response — user profile merged with RBAC grants */
|
|
32
32
|
export interface IUserWithGrants extends IUserProfile {
|
|
33
|
+
/**
|
|
34
|
+
* Currently active role used for request-bound permission checks.
|
|
35
|
+
* Picked from User.Role; defaults to User.Role[0] at login.
|
|
36
|
+
*/
|
|
37
|
+
ActiveRole: string;
|
|
38
|
+
Grants: IGrantsMap;
|
|
39
|
+
}
|
|
40
|
+
/** Response for /auth/active-role endpoints */
|
|
41
|
+
export interface IActiveRoleResponse {
|
|
42
|
+
ActiveRole: string;
|
|
43
|
+
AvailableRoles: string[];
|
|
33
44
|
Grants: IGrantsMap;
|
|
34
45
|
}
|
|
46
|
+
/** Response for /auth/impersonate when an impersonation has just been started or queried */
|
|
47
|
+
export interface IImpersonationResponse {
|
|
48
|
+
/** Target user (whose identity is now in effect) */
|
|
49
|
+
User: IUserProfile;
|
|
50
|
+
/** Original user who initiated the impersonation */
|
|
51
|
+
Impersonator: IUserProfile;
|
|
52
|
+
/** ActiveRole now in effect — defaults to target.Role[0] when impersonation starts */
|
|
53
|
+
ActiveRole: string;
|
|
54
|
+
/** Roles the target may switch to via /auth/active-role */
|
|
55
|
+
AvailableRoles: string[];
|
|
56
|
+
/** RBAC grants resolved for ActiveRole */
|
|
57
|
+
Grants: IGrantsMap;
|
|
58
|
+
/** ISO timestamp when impersonation was started */
|
|
59
|
+
StartedAt: string;
|
|
60
|
+
}
|
|
61
|
+
/** Lightweight status reply for GET /auth/impersonate */
|
|
62
|
+
export interface IImpersonationState {
|
|
63
|
+
Active: boolean;
|
|
64
|
+
ImpersonatorUuid?: string;
|
|
65
|
+
TargetUuid?: string;
|
|
66
|
+
StartedAt?: string;
|
|
67
|
+
}
|
|
35
68
|
/** Login response when TOTP verification step is still pending */
|
|
36
69
|
export interface ITwoFactorAuthRequired {
|
|
37
70
|
TwoFactorAuthRequired: true;
|
|
@@ -58,6 +91,23 @@ declare module '@spinajs/http' {
|
|
|
58
91
|
* eg. we want to read only current user data but it has admin privlidges too....
|
|
59
92
|
*/
|
|
60
93
|
PermissionScope?: PermissionType;
|
|
94
|
+
/**
|
|
95
|
+
* Currently selected role from User.Role for the request. Defaults to the
|
|
96
|
+
* first role in User.Role at login; can be changed via /auth/active-role.
|
|
97
|
+
*/
|
|
98
|
+
ActiveRole?: string;
|
|
99
|
+
/**
|
|
100
|
+
* Original logged-in user when an impersonation is active. `User` then
|
|
101
|
+
* holds the target user; `Impersonator` holds whoever initiated it.
|
|
102
|
+
* Null/undefined on regular requests.
|
|
103
|
+
*/
|
|
104
|
+
Impersonator?: User | null;
|
|
105
|
+
/**
|
|
106
|
+
* When set, RbacModelPermissionMiddleware skips injecting permission
|
|
107
|
+
* constraints into query builders for this request.
|
|
108
|
+
* Set via @SkipModelPermission() decorator.
|
|
109
|
+
*/
|
|
110
|
+
SkipModelPermissionCheck?: boolean;
|
|
61
111
|
}
|
|
62
112
|
}
|
|
63
113
|
export interface IRbacDescriptor {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAO/D,2CAA2C;AAC3C,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;IACtE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,oGAAoG;AACpG,MAAM,WAAW,SAAU,SAAQ,YAAY;IAC7C,QAAQ,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACjC;AAED,kFAAkF;AAClF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,CAAC;AAElF,gFAAgF;AAChF,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,kEAAkE;AAClE,MAAM,WAAW,sBAAsB;IACrC,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACrC,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED,yDAAyD;AACzD,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,sBAAsB,GAAG,sBAAsB,CAAC;AAE/F,qEAAqE;AACrE,MAAM,WAAW,kBAAkB;IACjC,wFAAwF;IACxF,GAAG,EAAE,MAAM,CAAC;CACb;AAGD,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,0BAA0B;QAClC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAClB,OAAO,EAAE,QAAQ,CAAC;QAElB;;;;;WAKG;QACH,eAAe,CAAC,EAAG,cAAc,CAAC;
|
|
1
|
+
{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAO/D,2CAA2C;AAC3C,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;IACtE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,oGAAoG;AACpG,MAAM,WAAW,SAAU,SAAQ,YAAY;IAC7C,QAAQ,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACjC;AAED,kFAAkF;AAClF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,CAAC;AAElF,gFAAgF;AAChF,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,+CAA+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,4FAA4F;AAC5F,MAAM,WAAW,sBAAsB;IACrC,oDAAoD;IACpD,IAAI,EAAE,YAAY,CAAC;IACnB,oDAAoD;IACpD,YAAY,EAAE,YAAY,CAAC;IAC3B,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,0CAA0C;IAC1C,MAAM,EAAE,UAAU,CAAC;IACnB,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,kEAAkE;AAClE,MAAM,WAAW,sBAAsB;IACrC,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACrC,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED,yDAAyD;AACzD,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,sBAAsB,GAAG,sBAAsB,CAAC;AAE/F,qEAAqE;AACrE,MAAM,WAAW,kBAAkB;IACjC,wFAAwF;IACxF,GAAG,EAAE,MAAM,CAAC;CACb;AAGD,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,0BAA0B;QAClC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAClB,OAAO,EAAE,QAAQ,CAAC;QAElB;;;;;WAKG;QACH,eAAe,CAAC,EAAG,cAAc,CAAC;QAElC;;;WAGG;QACH,UAAU,CAAC,EAAE,MAAM,CAAC;QAEpB;;;;WAIG;QACH,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;QAE3B;;;;WAIG;QACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;KACpC;CACF;AAGD,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,UAAU,EAAE,cAAc,EAAE,CAAC;IAE7B;;OAEG;IACH,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,8BAA8B;IAC7C;;OAEG;IACH,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,8BAAsB,qBAAqB;IACzC;;OAEG;aACa,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAE3D;;;;OAIG;aACa,OAAO,CAAC,IAAI,EAAG,IAAI,GAAI,OAAO,CAAC,IAAI,CAAC;IAEpD;;OAEG;aACa,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAElD;;OAEG;aACa,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAExE;;OAEG;aACa,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAEvD;;;;OAIG;aACa,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAE3D;;;;;OAKG;aACa,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAClE;AAED,8BAAsB,mBAAmB;CAAG;AAE5C,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":";;;AAkKA,MAAsB,qBAAqB;CA0C1C;AA1CD,sDA0CC;AAED,MAAsB,mBAAmB;CAAG;AAA5C,kDAA4C"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"middlewares.d.ts","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,eAAe,EAAQ,MAAM,eAAe,CAAC;AAEhE,OAAO,kBAAkB,CAAC;AAC1B,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAGnC,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtE,qBACa,cAAe,SAAQ,gBAAgB;IAElD,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC;IAGhC,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAE9B,OAAO;IAMb,MAAM,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI;
|
|
1
|
+
{"version":3,"file":"middlewares.d.ts","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,eAAe,EAAQ,MAAM,eAAe,CAAC;AAEhE,OAAO,kBAAkB,CAAC;AAC1B,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAGnC,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtE,qBACa,cAAe,SAAQ,gBAAgB;IAElD,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC;IAGhC,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAE9B,OAAO;IAMb,MAAM,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI;IA0CpF,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,GAAG,IAAI;CAGpG"}
|
package/lib/cjs/middlewares.js
CHANGED
|
@@ -72,9 +72,21 @@ let RbacMiddleware = class RbacMiddleware extends http_1.ServerMiddleware {
|
|
|
72
72
|
*/
|
|
73
73
|
req.storage.User = await di_1.DI.resolve('RbacUserFactory', [session.Data.get('User')]);
|
|
74
74
|
req.storage.Session = session;
|
|
75
|
+
// When impersonation is active, session.Data.User is the *target*
|
|
76
|
+
// user. Resolve the original (Impersonator) alongside so downstream
|
|
77
|
+
// code can render banners, audit actions, and end the impersonation.
|
|
78
|
+
const impersonatorUuid = session.Data.get('Impersonator');
|
|
79
|
+
if (impersonatorUuid) {
|
|
80
|
+
req.storage.Impersonator = await di_1.DI.resolve('RbacUserFactory', [impersonatorUuid]);
|
|
81
|
+
}
|
|
82
|
+
const sessionActiveRole = session.Data.get('ActiveRole');
|
|
83
|
+
req.storage.ActiveRole = sessionActiveRole && req.storage.User.Role.includes(sessionActiveRole)
|
|
84
|
+
? sessionActiveRole
|
|
85
|
+
: req.storage.User.Role?.[0];
|
|
75
86
|
}
|
|
76
87
|
else {
|
|
77
88
|
req.storage.User = di_1.DI.resolve('RbacGuestUserFactory');
|
|
89
|
+
req.storage.ActiveRole = req.storage.User.Role?.[0];
|
|
78
90
|
}
|
|
79
91
|
next();
|
|
80
92
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"middlewares.js","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,wCAAgE;AAChE,oCAAyD;AACzD,4BAA0B;AAE1B,0DAAgD;AAChD,qDAAuC;AACvC,wCAAsE;AAG/D,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,uBAAgB;IAO3C,KAAK,CAAC,OAAO;QAClB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,gHAAgH,CAAC,CAAC;QACpI,CAAC;IACH,CAAC;IAEM,MAAM;QACX,OAAO,KAAK,EAAE,GAAa,EAAE,IAAsB,EAAE,IAA0B,EAAE,EAAE;YACjF,IAAI,CAAC;gBACH,IAAI,OAAO,GAAoB,IAAI,CAAC;gBACpC,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;oBACtB,MAAM,IAAI,GAAmB,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;oBAC7E,IAAI,IAAI,EAAE,CAAC;wBACT,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBACrD,CAAC;gBACH,CAAC;gBAED,IAAI,OAAO,EAAE,CAAC;oBACZ;;;uBAGG;oBACH,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,MAAM,OAAE,CAAC,OAAO,CAAO,iBAAiB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBACzF,GAAG,CAAC,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;
|
|
1
|
+
{"version":3,"file":"middlewares.js","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,wCAAgE;AAChE,oCAAyD;AACzD,4BAA0B;AAE1B,0DAAgD;AAChD,qDAAuC;AACvC,wCAAsE;AAG/D,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,uBAAgB;IAO3C,KAAK,CAAC,OAAO;QAClB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,gHAAgH,CAAC,CAAC;QACpI,CAAC;IACH,CAAC;IAEM,MAAM;QACX,OAAO,KAAK,EAAE,GAAa,EAAE,IAAsB,EAAE,IAA0B,EAAE,EAAE;YACjF,IAAI,CAAC;gBACH,IAAI,OAAO,GAAoB,IAAI,CAAC;gBACpC,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;oBACtB,MAAM,IAAI,GAAmB,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;oBAC7E,IAAI,IAAI,EAAE,CAAC;wBACT,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBACrD,CAAC;gBACH,CAAC;gBAED,IAAI,OAAO,EAAE,CAAC;oBACZ;;;uBAGG;oBACH,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,MAAM,OAAE,CAAC,OAAO,CAAO,iBAAiB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBACzF,GAAG,CAAC,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;oBAE9B,kEAAkE;oBAClE,oEAAoE;oBACpE,qEAAqE;oBACrE,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAuB,CAAC;oBAChF,IAAI,gBAAgB,EAAE,CAAC;wBACrB,GAAG,CAAC,OAAO,CAAC,YAAY,GAAG,MAAM,OAAE,CAAC,OAAO,CAAO,iBAAiB,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;oBAC3F,CAAC;oBAED,MAAM,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAuB,CAAC;oBAC/E,GAAG,CAAC,OAAO,CAAC,UAAU,GAAG,iBAAiB,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;wBAC7F,CAAC,CAAC,iBAAiB;wBACnB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACjC,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,OAAE,CAAC,OAAO,CAAO,sBAAsB,CAAC,CAAC;oBAC5D,GAAG,CAAC,OAAO,CAAC,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACtD,CAAC;gBAED,IAAI,EAAE,CAAC;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IACM,KAAK;QACV,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA1DY,wCAAc;AAEf;IADT,IAAA,sBAAM,EAAC,oBAAoB,CAAC;;qDACG;AAGtB;IADT,IAAA,eAAU,GAAE;8BACc,sBAAe;uDAAC;yBALhC,cAAc;IAD1B,IAAA,eAAU,EAAC,uBAAgB,CAAC;GAChB,cAAc,CA0D1B"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"RbacPolicy.d.ts","sourceRoot":"","sources":["../../../src/policies/RbacPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAe,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAKlG,OAAO,EAAkB,IAAI,EAAE,MAAM,eAAe,CAAC;AAErD;;GAEG;AACH,qBAAa,UAAW,SAAQ,UAAU;IACxC,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;;IAQrB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO;IAKrD,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW;
|
|
1
|
+
{"version":3,"file":"RbacPolicy.d.ts","sourceRoot":"","sources":["../../../src/policies/RbacPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAe,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAKlG,OAAO,EAAkB,IAAI,EAAE,MAAM,eAAe,CAAC;AAErD;;GAEG;AACH,qBAAa,UAAW,SAAQ,UAAU;IACxC,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;;IAQrB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO;IAKrD,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW;CA0B1E;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,CAG7G;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAQvG;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAQ3G"}
|
|
@@ -38,7 +38,8 @@ class RbacPolicy extends http_1.BasePolicy {
|
|
|
38
38
|
throw new exceptions_1.AuthenticationFailed('user not logged or session expired');
|
|
39
39
|
}
|
|
40
40
|
if (!permission.some(p => checkRoutePermission(req, descriptor.Resource, p)?.granted)) {
|
|
41
|
-
|
|
41
|
+
const effective = req.storage.ActiveRole ?? req.storage.User.Role;
|
|
42
|
+
throw new exceptions_1.Forbidden(`role(s) ${effective} does not have permission ${permission} for resource ${descriptor.Resource}`);
|
|
42
43
|
}
|
|
43
44
|
}
|
|
44
45
|
}
|
|
@@ -58,6 +59,8 @@ function checkRoutePermission(req, resource, permission) {
|
|
|
58
59
|
if (!req.storage || !req.storage.User) {
|
|
59
60
|
return null;
|
|
60
61
|
}
|
|
61
|
-
|
|
62
|
+
const ac = di_1.DI.get('AccessControl');
|
|
63
|
+
const roles = req.storage.ActiveRole ? [req.storage.ActiveRole] : req.storage.User.Role;
|
|
64
|
+
return ac.can(roles)[permission](resource);
|
|
62
65
|
}
|
|
63
66
|
//# sourceMappingURL=RbacPolicy.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"RbacPolicy.js","sourceRoot":"","sources":["../../../src/policies/RbacPolicy.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"RbacPolicy.js","sourceRoot":"","sources":["../../../src/policies/RbacPolicy.ts"],"names":[],"mappings":";;;AAqDA,kDAGC;AAED,kDAQC;AAED,oDAQC;AA3ED,wCAAkG;AAClG,oDAAsE;AACtE,oDAA6D;AAE7D,oCAAiC;AAGjC;;GAEG;AACH,MAAa,UAAW,SAAQ,iBAAU;IAGxC;QACE,KAAK,EAAE,CAAC;QAER,IAAI,CAAC,EAAE,GAAG,OAAE,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC;IACrC,CAAC;IAEM,SAAS,CAAC,OAAe,EAAE,SAAsB;QACtD,0BAA0B;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,GAAa,EAAE,MAAc,EAAE,QAAqB;QACvE,MAAM,UAAU,GAAoB,OAAO,CAAC,WAAW,CAAC,yCAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7F,IAAI,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;QAE7C,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACjD,gFAAgF;YAChF,IAAI,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBACtC,GAAG,CAAC,OAAO,CAAC,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAmB,IAAI,IAAI,CAAC;YAC5F,CAAC;YACD,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAE,CAAC,UAAU,IAAI,EAAE,CAAC;QAC9E,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,kBAAW,CAAC,2CAA2C,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7G,MAAM,IAAI,iCAAoB,CAAC,oCAAoC,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;YACtF,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAClE,MAAM,IAAI,sBAAS,CAAC,WAAW,SAAS,6BAA6B,UAAU,iBAAiB,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzH,CAAC;IACH,CAAC;CACF;AAxCD,gCAwCC;AAED,SAAgB,mBAAmB,CAAC,IAAuB,EAAE,QAAgB,EAAE,UAAkB;IAC/F,MAAM,EAAE,GAAG,OAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACnD,OAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED,SAAgB,mBAAmB,CAAC,IAAU,EAAE,QAAgB,EAAE,UAAkB;IAClF,MAAM,EAAE,GAAG,OAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IAEnD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAED,SAAgB,oBAAoB,CAAC,GAAa,EAAE,QAAgB,EAAE,UAAkB;IACtF,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,OAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;IACxF,OAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;AACtD,CAAC"}
|
package/lib/mjs/decorators.d.ts
CHANGED
|
@@ -20,6 +20,15 @@ export declare function Resource(resource: string, permission?: PermissionType[]
|
|
|
20
20
|
* @param permission - permission to set
|
|
21
21
|
*/
|
|
22
22
|
export declare function Permission(permission?: PermissionType[]): any;
|
|
23
|
+
/**
|
|
24
|
+
* Disables RbacModelPermissionMiddleware for controller action ( or whole controller when applied to class ).
|
|
25
|
+
*
|
|
26
|
+
* Use for actions that are assumed safe to execute - rbac permission
|
|
27
|
+
* constraints will NOT be injected into query builders for queries
|
|
28
|
+
* executed within the action. Route-level permission checks ( RbacPolicy )
|
|
29
|
+
* are NOT affected by this decorator.
|
|
30
|
+
*/
|
|
31
|
+
export declare function SkipModelPermission(): (target: any, propertyKey?: string | symbol, indexOrDescriptor?: number | PropertyDescriptor) => void;
|
|
23
32
|
/**
|
|
24
33
|
* Retrieves user from session if is logged in
|
|
25
34
|
*/
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"decorators.d.ts","sourceRoot":"","sources":["../../src/decorators.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAkC,MAAM,iBAAiB,CAAC;AAGlF,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"decorators.d.ts","sourceRoot":"","sources":["../../src/decorators.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAkC,MAAM,iBAAiB,CAAC;AAGlF,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG/C;;;GAGG;AACH,eAAO,MAAM,yBAAyB,eAAiD,CAAC;AAExF,wBAAgB,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,IAAI,QAerF;AAqBD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,GAAE,cAAc,EAAgB,OAKpF;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,UAAU,GAAE,cAAc,EAAgB,OAapE;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,0GAalC;AAED;;GAEG;AACH,wBAAgB,IAAI,0GAEnB;AAED;;GAEG;AACH,wBAAgB,WAAW,0GAE1B;AAED,wBAAgB,OAAO,0GAEtB"}
|
package/lib/mjs/decorators.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { Parameter, Policy, Route } from '@spinajs/http';
|
|
1
|
+
import { Middleware, Parameter, Policy, Route, RouteMiddleware } from '@spinajs/http';
|
|
2
2
|
import { RbacPolicy } from './policies/RbacPolicy.js';
|
|
3
3
|
/**
|
|
4
4
|
* Global symbol so external packages (e.g. http-swagger) can read the RBAC
|
|
@@ -66,6 +66,26 @@ export function Permission(permission = ['readOwn']) {
|
|
|
66
66
|
Policy(RbacPolicy)(target, propertyKey, undefined);
|
|
67
67
|
});
|
|
68
68
|
}
|
|
69
|
+
/**
|
|
70
|
+
* Disables RbacModelPermissionMiddleware for controller action ( or whole controller when applied to class ).
|
|
71
|
+
*
|
|
72
|
+
* Use for actions that are assumed safe to execute - rbac permission
|
|
73
|
+
* constraints will NOT be injected into query builders for queries
|
|
74
|
+
* executed within the action. Route-level permission checks ( RbacPolicy )
|
|
75
|
+
* are NOT affected by this decorator.
|
|
76
|
+
*/
|
|
77
|
+
export function SkipModelPermission() {
|
|
78
|
+
return Middleware(class extends RouteMiddleware {
|
|
79
|
+
isEnabled(_route, _controller) {
|
|
80
|
+
return true;
|
|
81
|
+
}
|
|
82
|
+
async onBefore(req, _res, _route, _controller) {
|
|
83
|
+
req.storage.SkipModelPermissionCheck = true;
|
|
84
|
+
}
|
|
85
|
+
async onResponse(_response, _route, _controller) { }
|
|
86
|
+
async onAfter(_req, _res, _route, _controller) { }
|
|
87
|
+
});
|
|
88
|
+
}
|
|
69
89
|
/**
|
|
70
90
|
* Retrieves user from session if is logged in
|
|
71
91
|
*/
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"decorators.js","sourceRoot":"","sources":["../../src/decorators.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"decorators.js","sourceRoot":"","sources":["../../src/decorators.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAiC,MAAM,eAAe,CAAC;AAC1I,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAItD;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;AAExF,MAAM,UAAU,eAAe,CAAC,MAAW,EAAE,QAAyC;IACpF,IAAI,QAAQ,GAAoB,OAAO,CAAC,WAAW,CAAC,yBAAyB,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;IAC3G,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG;YACT,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,IAAI,GAAG,EAA0C;YACzD,UAAU,EAAE,CAAC,SAAS,CAAC;SACxB,CAAC;QAEF,OAAO,CAAC,cAAc,CAAC,yBAAyB,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,QAA0I;IAC5J,OAAO,CAAC,MAAW,EAAE,WAA4B,EAAE,iBAA8C,EAAE,EAAE;QACnG,IAAI,QAAQ,GAAoB,OAAO,CAAC,WAAW,CAAC,yBAAyB,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;QAC3G,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG;gBACT,QAAQ,EAAE,EAAE;gBACZ,MAAM,EAAE,IAAI,GAAG,EAA0C;gBACzD,UAAU,EAAE,CAAC,SAAS,CAAC;aACxB,CAAC;YAEF,OAAO,CAAC,cAAc,CAAC,yBAAyB,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,aAA+B,CAAC,SAAS,CAAC;IACnF,OAAO,UAAU,CAAC,CAAC,QAAyB,EAAE,EAAE;QAC9C,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC7B,QAAQ,CAAC,UAAU,GAAG,UAAU,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,aAA+B,CAAC,SAAS,CAAC;IACnE,OAAO,UAAU,CAAC,CAAC,QAAyB,EAAE,MAAW,EAAE,WAAmB,EAAE,EAAE;QAChF,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,MAAM,KAAK,GAAG;oBACZ,UAAU,EAAE,UAAU;iBACvB,CAAC;gBACF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,UAAU,CACf,KAAM,SAAQ,eAAe;QACpB,SAAS,CAAC,MAAc,EAAE,WAAwB;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;QACM,KAAK,CAAC,QAAQ,CAAC,GAAoB,EAAE,IAAsB,EAAE,MAAc,EAAE,WAAwB;YACzG,GAAgB,CAAC,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;QAC5D,CAAC;QACM,KAAK,CAAC,UAAU,CAAC,SAAmB,EAAE,MAAc,EAAE,WAAwB,IAAkB,CAAC;QACjG,KAAK,CAAC,OAAO,CAAC,IAAqB,EAAE,IAAsB,EAAE,MAAc,EAAE,WAAwB,IAAkB,CAAC;KAChI,CACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,IAAI;IAClB,OAAO,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,KAAK,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,OAAO;IACrB,OAAO,KAAK,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC;AAC/C,CAAC"}
|
package/lib/mjs/interfaces.d.ts
CHANGED
|
@@ -30,8 +30,41 @@ export type IGrantsMap = Record<string, Record<string, {
|
|
|
30
30
|
}>>;
|
|
31
31
|
/** Successful authentication response — user profile merged with RBAC grants */
|
|
32
32
|
export interface IUserWithGrants extends IUserProfile {
|
|
33
|
+
/**
|
|
34
|
+
* Currently active role used for request-bound permission checks.
|
|
35
|
+
* Picked from User.Role; defaults to User.Role[0] at login.
|
|
36
|
+
*/
|
|
37
|
+
ActiveRole: string;
|
|
38
|
+
Grants: IGrantsMap;
|
|
39
|
+
}
|
|
40
|
+
/** Response for /auth/active-role endpoints */
|
|
41
|
+
export interface IActiveRoleResponse {
|
|
42
|
+
ActiveRole: string;
|
|
43
|
+
AvailableRoles: string[];
|
|
33
44
|
Grants: IGrantsMap;
|
|
34
45
|
}
|
|
46
|
+
/** Response for /auth/impersonate when an impersonation has just been started or queried */
|
|
47
|
+
export interface IImpersonationResponse {
|
|
48
|
+
/** Target user (whose identity is now in effect) */
|
|
49
|
+
User: IUserProfile;
|
|
50
|
+
/** Original user who initiated the impersonation */
|
|
51
|
+
Impersonator: IUserProfile;
|
|
52
|
+
/** ActiveRole now in effect — defaults to target.Role[0] when impersonation starts */
|
|
53
|
+
ActiveRole: string;
|
|
54
|
+
/** Roles the target may switch to via /auth/active-role */
|
|
55
|
+
AvailableRoles: string[];
|
|
56
|
+
/** RBAC grants resolved for ActiveRole */
|
|
57
|
+
Grants: IGrantsMap;
|
|
58
|
+
/** ISO timestamp when impersonation was started */
|
|
59
|
+
StartedAt: string;
|
|
60
|
+
}
|
|
61
|
+
/** Lightweight status reply for GET /auth/impersonate */
|
|
62
|
+
export interface IImpersonationState {
|
|
63
|
+
Active: boolean;
|
|
64
|
+
ImpersonatorUuid?: string;
|
|
65
|
+
TargetUuid?: string;
|
|
66
|
+
StartedAt?: string;
|
|
67
|
+
}
|
|
35
68
|
/** Login response when TOTP verification step is still pending */
|
|
36
69
|
export interface ITwoFactorAuthRequired {
|
|
37
70
|
TwoFactorAuthRequired: true;
|
|
@@ -58,6 +91,23 @@ declare module '@spinajs/http' {
|
|
|
58
91
|
* eg. we want to read only current user data but it has admin privlidges too....
|
|
59
92
|
*/
|
|
60
93
|
PermissionScope?: PermissionType;
|
|
94
|
+
/**
|
|
95
|
+
* Currently selected role from User.Role for the request. Defaults to the
|
|
96
|
+
* first role in User.Role at login; can be changed via /auth/active-role.
|
|
97
|
+
*/
|
|
98
|
+
ActiveRole?: string;
|
|
99
|
+
/**
|
|
100
|
+
* Original logged-in user when an impersonation is active. `User` then
|
|
101
|
+
* holds the target user; `Impersonator` holds whoever initiated it.
|
|
102
|
+
* Null/undefined on regular requests.
|
|
103
|
+
*/
|
|
104
|
+
Impersonator?: User | null;
|
|
105
|
+
/**
|
|
106
|
+
* When set, RbacModelPermissionMiddleware skips injecting permission
|
|
107
|
+
* constraints into query builders for this request.
|
|
108
|
+
* Set via @SkipModelPermission() decorator.
|
|
109
|
+
*/
|
|
110
|
+
SkipModelPermissionCheck?: boolean;
|
|
61
111
|
}
|
|
62
112
|
}
|
|
63
113
|
export interface IRbacDescriptor {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAO/D,2CAA2C;AAC3C,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;IACtE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,oGAAoG;AACpG,MAAM,WAAW,SAAU,SAAQ,YAAY;IAC7C,QAAQ,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACjC;AAED,kFAAkF;AAClF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,CAAC;AAElF,gFAAgF;AAChF,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,kEAAkE;AAClE,MAAM,WAAW,sBAAsB;IACrC,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACrC,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED,yDAAyD;AACzD,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,sBAAsB,GAAG,sBAAsB,CAAC;AAE/F,qEAAqE;AACrE,MAAM,WAAW,kBAAkB;IACjC,wFAAwF;IACxF,GAAG,EAAE,MAAM,CAAC;CACb;AAGD,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,0BAA0B;QAClC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAClB,OAAO,EAAE,QAAQ,CAAC;QAElB;;;;;WAKG;QACH,eAAe,CAAC,EAAG,cAAc,CAAC;
|
|
1
|
+
{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAO/D,2CAA2C;AAC3C,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;IACtE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,oGAAoG;AACpG,MAAM,WAAW,SAAU,SAAQ,YAAY;IAC7C,QAAQ,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACjC;AAED,kFAAkF;AAClF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,CAAC;AAElF,gFAAgF;AAChF,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,+CAA+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,4FAA4F;AAC5F,MAAM,WAAW,sBAAsB;IACrC,oDAAoD;IACpD,IAAI,EAAE,YAAY,CAAC;IACnB,oDAAoD;IACpD,YAAY,EAAE,YAAY,CAAC;IAC3B,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,0CAA0C;IAC1C,MAAM,EAAE,UAAU,CAAC;IACnB,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,kEAAkE;AAClE,MAAM,WAAW,sBAAsB;IACrC,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACrC,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED,yDAAyD;AACzD,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,sBAAsB,GAAG,sBAAsB,CAAC;AAE/F,qEAAqE;AACrE,MAAM,WAAW,kBAAkB;IACjC,wFAAwF;IACxF,GAAG,EAAE,MAAM,CAAC;CACb;AAGD,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,0BAA0B;QAClC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAClB,OAAO,EAAE,QAAQ,CAAC;QAElB;;;;;WAKG;QACH,eAAe,CAAC,EAAG,cAAc,CAAC;QAElC;;;WAGG;QACH,UAAU,CAAC,EAAE,MAAM,CAAC;QAEpB;;;;WAIG;QACH,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;QAE3B;;;;WAIG;QACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;KACpC;CACF;AAGD,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,UAAU,EAAE,cAAc,EAAE,CAAC;IAE7B;;OAEG;IACH,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,8BAA8B;IAC7C;;OAEG;IACH,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,8BAAsB,qBAAqB;IACzC;;OAEG;aACa,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAE3D;;;;OAIG;aACa,OAAO,CAAC,IAAI,EAAG,IAAI,GAAI,OAAO,CAAC,IAAI,CAAC;IAEpD;;OAEG;aACa,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAElD;;OAEG;aACa,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAExE;;OAEG;aACa,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAEvD;;;;OAIG;aACa,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAE3D;;;;;OAKG;aACa,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAClE;AAED,8BAAsB,mBAAmB;CAAG;AAE5C,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAkKA,MAAM,OAAgB,qBAAqB;CA0C1C;AAED,MAAM,OAAgB,mBAAmB;CAAG"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"middlewares.d.ts","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,eAAe,EAAQ,MAAM,eAAe,CAAC;AAEhE,OAAO,kBAAkB,CAAC;AAC1B,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAGnC,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtE,qBACa,cAAe,SAAQ,gBAAgB;IAElD,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC;IAGhC,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAE9B,OAAO;IAMb,MAAM,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI;
|
|
1
|
+
{"version":3,"file":"middlewares.d.ts","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,eAAe,EAAQ,MAAM,eAAe,CAAC;AAEhE,OAAO,kBAAkB,CAAC;AAC1B,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAGnC,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtE,qBACa,cAAe,SAAQ,gBAAgB;IAElD,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC;IAGhC,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAE9B,OAAO;IAMb,MAAM,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI;IA0CpF,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,GAAG,IAAI;CAGpG"}
|
package/lib/mjs/middlewares.js
CHANGED
|
@@ -36,9 +36,21 @@ let RbacMiddleware = class RbacMiddleware extends ServerMiddleware {
|
|
|
36
36
|
*/
|
|
37
37
|
req.storage.User = await DI.resolve('RbacUserFactory', [session.Data.get('User')]);
|
|
38
38
|
req.storage.Session = session;
|
|
39
|
+
// When impersonation is active, session.Data.User is the *target*
|
|
40
|
+
// user. Resolve the original (Impersonator) alongside so downstream
|
|
41
|
+
// code can render banners, audit actions, and end the impersonation.
|
|
42
|
+
const impersonatorUuid = session.Data.get('Impersonator');
|
|
43
|
+
if (impersonatorUuid) {
|
|
44
|
+
req.storage.Impersonator = await DI.resolve('RbacUserFactory', [impersonatorUuid]);
|
|
45
|
+
}
|
|
46
|
+
const sessionActiveRole = session.Data.get('ActiveRole');
|
|
47
|
+
req.storage.ActiveRole = sessionActiveRole && req.storage.User.Role.includes(sessionActiveRole)
|
|
48
|
+
? sessionActiveRole
|
|
49
|
+
: req.storage.User.Role?.[0];
|
|
39
50
|
}
|
|
40
51
|
else {
|
|
41
52
|
req.storage.User = DI.resolve('RbacGuestUserFactory');
|
|
53
|
+
req.storage.ActiveRole = req.storage.User.Role?.[0];
|
|
42
54
|
}
|
|
43
55
|
next();
|
|
44
56
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"middlewares.js","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAY,eAAe,EAAQ,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAuB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAG/D,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,gBAAgB;IAO3C,KAAK,CAAC,OAAO;QAClB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,gHAAgH,CAAC,CAAC;QACpI,CAAC;IACH,CAAC;IAEM,MAAM;QACX,OAAO,KAAK,EAAE,GAAa,EAAE,IAAsB,EAAE,IAA0B,EAAE,EAAE;YACjF,IAAI,CAAC;gBACH,IAAI,OAAO,GAAoB,IAAI,CAAC;gBACpC,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;oBACtB,MAAM,IAAI,GAAmB,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;oBAC7E,IAAI,IAAI,EAAE,CAAC;wBACT,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBACrD,CAAC;gBACH,CAAC;gBAED,IAAI,OAAO,EAAE,CAAC;oBACZ;;;uBAGG;oBACH,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAO,iBAAiB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBACzF,GAAG,CAAC,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;
|
|
1
|
+
{"version":3,"file":"middlewares.js","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAY,eAAe,EAAQ,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAuB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAG/D,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,gBAAgB;IAO3C,KAAK,CAAC,OAAO;QAClB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,gHAAgH,CAAC,CAAC;QACpI,CAAC;IACH,CAAC;IAEM,MAAM;QACX,OAAO,KAAK,EAAE,GAAa,EAAE,IAAsB,EAAE,IAA0B,EAAE,EAAE;YACjF,IAAI,CAAC;gBACH,IAAI,OAAO,GAAoB,IAAI,CAAC;gBACpC,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;oBACtB,MAAM,IAAI,GAAmB,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;oBAC7E,IAAI,IAAI,EAAE,CAAC;wBACT,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBACrD,CAAC;gBACH,CAAC;gBAED,IAAI,OAAO,EAAE,CAAC;oBACZ;;;uBAGG;oBACH,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAO,iBAAiB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBACzF,GAAG,CAAC,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;oBAE9B,kEAAkE;oBAClE,oEAAoE;oBACpE,qEAAqE;oBACrE,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAuB,CAAC;oBAChF,IAAI,gBAAgB,EAAE,CAAC;wBACrB,GAAG,CAAC,OAAO,CAAC,YAAY,GAAG,MAAM,EAAE,CAAC,OAAO,CAAO,iBAAiB,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;oBAC3F,CAAC;oBAED,MAAM,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAuB,CAAC;oBAC/E,GAAG,CAAC,OAAO,CAAC,UAAU,GAAG,iBAAiB,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;wBAC7F,CAAC,CAAC,iBAAiB;wBACnB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACjC,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE,CAAC,OAAO,CAAO,sBAAsB,CAAC,CAAC;oBAC5D,GAAG,CAAC,OAAO,CAAC,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACtD,CAAC;gBAED,IAAI,EAAE,CAAC;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IACM,KAAK;QACV,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAxDW;IADT,MAAM,CAAC,oBAAoB,CAAC;;qDACG;AAGtB;IADT,UAAU,EAAE;8BACc,eAAe;uDAAC;AALhC,cAAc;IAD1B,UAAU,CAAC,gBAAgB,CAAC;GAChB,cAAc,CA0D1B"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"RbacPolicy.d.ts","sourceRoot":"","sources":["../../../src/policies/RbacPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAe,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAKlG,OAAO,EAAkB,IAAI,EAAE,MAAM,eAAe,CAAC;AAErD;;GAEG;AACH,qBAAa,UAAW,SAAQ,UAAU;IACxC,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;;IAQrB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO;IAKrD,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW;
|
|
1
|
+
{"version":3,"file":"RbacPolicy.d.ts","sourceRoot":"","sources":["../../../src/policies/RbacPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAe,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAKlG,OAAO,EAAkB,IAAI,EAAE,MAAM,eAAe,CAAC;AAErD;;GAEG;AACH,qBAAa,UAAW,SAAQ,UAAU;IACxC,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;;IAQrB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO;IAKrD,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW;CA0B1E;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,CAG7G;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAQvG;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAQ3G"}
|
|
@@ -32,7 +32,8 @@ export class RbacPolicy extends BasePolicy {
|
|
|
32
32
|
throw new AuthenticationFailed('user not logged or session expired');
|
|
33
33
|
}
|
|
34
34
|
if (!permission.some(p => checkRoutePermission(req, descriptor.Resource, p)?.granted)) {
|
|
35
|
-
|
|
35
|
+
const effective = req.storage.ActiveRole ?? req.storage.User.Role;
|
|
36
|
+
throw new Forbidden(`role(s) ${effective} does not have permission ${permission} for resource ${descriptor.Resource}`);
|
|
36
37
|
}
|
|
37
38
|
}
|
|
38
39
|
}
|
|
@@ -51,6 +52,8 @@ export function checkRoutePermission(req, resource, permission) {
|
|
|
51
52
|
if (!req.storage || !req.storage.User) {
|
|
52
53
|
return null;
|
|
53
54
|
}
|
|
54
|
-
|
|
55
|
+
const ac = DI.get('AccessControl');
|
|
56
|
+
const roles = req.storage.ActiveRole ? [req.storage.ActiveRole] : req.storage.User.Role;
|
|
57
|
+
return ac.can(roles)[permission](resource);
|
|
55
58
|
}
|
|
56
59
|
//# sourceMappingURL=RbacPolicy.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"RbacPolicy.js","sourceRoot":"","sources":["../../../src/policies/RbacPolicy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAuB,WAAW,EAAuB,MAAM,eAAe,CAAC;AAClG,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAE7D,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGjC;;GAEG;AACH,MAAM,OAAO,UAAW,SAAQ,UAAU;IAGxC;QACE,KAAK,EAAE,CAAC;QAER,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC;IACrC,CAAC;IAEM,SAAS,CAAC,OAAe,EAAE,SAAsB;QACtD,0BAA0B;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,GAAa,EAAE,MAAc,EAAE,QAAqB;QACvE,MAAM,UAAU,GAAoB,OAAO,CAAC,WAAW,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7F,IAAI,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;QAE7C,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACjD,gFAAgF;YAChF,IAAI,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBACtC,GAAG,CAAC,OAAO,CAAC,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAmB,IAAI,IAAI,CAAC;YAC5F,CAAC;YACD,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAE,CAAC,UAAU,IAAI,EAAE,CAAC;QAC9E,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,WAAW,CAAC,2CAA2C,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7G,MAAM,IAAI,oBAAoB,CAAC,oCAAoC,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;YACtF,MAAM,
|
|
1
|
+
{"version":3,"file":"RbacPolicy.js","sourceRoot":"","sources":["../../../src/policies/RbacPolicy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAuB,WAAW,EAAuB,MAAM,eAAe,CAAC;AAClG,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAE7D,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGjC;;GAEG;AACH,MAAM,OAAO,UAAW,SAAQ,UAAU;IAGxC;QACE,KAAK,EAAE,CAAC;QAER,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC;IACrC,CAAC;IAEM,SAAS,CAAC,OAAe,EAAE,SAAsB;QACtD,0BAA0B;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,GAAa,EAAE,MAAc,EAAE,QAAqB;QACvE,MAAM,UAAU,GAAoB,OAAO,CAAC,WAAW,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7F,IAAI,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;QAE7C,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACjD,gFAAgF;YAChF,IAAI,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBACtC,GAAG,CAAC,OAAO,CAAC,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAmB,IAAI,IAAI,CAAC;YAC5F,CAAC;YACD,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAE,CAAC,UAAU,IAAI,EAAE,CAAC;QAC9E,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,WAAW,CAAC,2CAA2C,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7G,MAAM,IAAI,oBAAoB,CAAC,oCAAoC,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;YACtF,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAClE,MAAM,IAAI,SAAS,CAAC,WAAW,SAAS,6BAA6B,UAAU,iBAAiB,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzH,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAuB,EAAE,QAAgB,EAAE,UAAkB;IAC/F,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACnD,OAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAU,EAAE,QAAgB,EAAE,UAAkB;IAClF,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IAEnD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAa,EAAE,QAAgB,EAAE,UAAkB;IACtF,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;IACxF,OAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;AACtD,CAAC"}
|