@spinajs/rbac-http 2.0.513 → 2.0.515
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/cjs/policies/RbacPolicy.d.ts +1 -1
- package/lib/cjs/policies/RbacPolicy.d.ts.map +1 -1
- package/lib/cjs/policies/RbacPolicy.js +45 -4
- package/lib/cjs/policies/RbacPolicy.js.map +1 -1
- package/lib/mjs/policies/RbacPolicy.d.ts +1 -1
- package/lib/mjs/policies/RbacPolicy.d.ts.map +1 -1
- package/lib/mjs/policies/RbacPolicy.js +45 -4
- package/lib/mjs/policies/RbacPolicy.js.map +1 -1
- package/lib/tsconfig.cjs.tsbuildinfo +1 -1
- package/lib/tsconfig.mjs.tsbuildinfo +1 -1
- package/package.json +10 -10
|
@@ -10,7 +10,7 @@ export declare class RbacPolicy extends BasePolicy {
|
|
|
10
10
|
isEnabled(_action: IRoute, _instance: IController): boolean;
|
|
11
11
|
execute(req: sRequest, action: IRoute, instance: IController): Promise<void>;
|
|
12
12
|
}
|
|
13
|
-
export declare function checkRbacPermission(role: string | string[], resource: string, permission: string): Permission;
|
|
13
|
+
export declare function checkRbacPermission(role: string | string[], resource: string, permission: string): Permission | null;
|
|
14
14
|
export declare function checkUserPermission(user: User, resource: string, permission: string): Permission | null;
|
|
15
15
|
export declare function checkRoutePermission(req: sRequest, resource: string, permission: string): Permission | null;
|
|
16
16
|
//# sourceMappingURL=RbacPolicy.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"RbacPolicy.d.ts","sourceRoot":"","sources":["../../../src/policies/RbacPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAe,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAKlG,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC;;GAEG;AACH,qBAAa,UAAW,SAAQ,UAAU;IACxC,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B,cAIC;IAEM,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO,CAGjE;IAEY,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,iBA2CxE;CACF;
|
|
1
|
+
{"version":3,"file":"RbacPolicy.d.ts","sourceRoot":"","sources":["../../../src/policies/RbacPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAe,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAKlG,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC;;GAEG;AACH,qBAAa,UAAW,SAAQ,UAAU;IACxC,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B,cAIC;IAEM,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO,CAGjE;IAEY,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,iBA2CxE;CACF;AA2CD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAGpH;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAOvG;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAQ3G"}
|
|
@@ -4,6 +4,7 @@ exports.RbacPolicy = void 0;
|
|
|
4
4
|
exports.checkRbacPermission = checkRbacPermission;
|
|
5
5
|
exports.checkUserPermission = checkUserPermission;
|
|
6
6
|
exports.checkRoutePermission = checkRoutePermission;
|
|
7
|
+
const accesscontrol_1 = require("accesscontrol");
|
|
7
8
|
const http_1 = require("@spinajs/http");
|
|
8
9
|
const exceptions_1 = require("@spinajs/exceptions");
|
|
9
10
|
const decorators_js_1 = require("../decorators.js");
|
|
@@ -60,16 +61,56 @@ class RbacPolicy extends http_1.BasePolicy {
|
|
|
60
61
|
}
|
|
61
62
|
}
|
|
62
63
|
exports.RbacPolicy = RbacPolicy;
|
|
64
|
+
/**
|
|
65
|
+
* Runs `ac.can(roles)[permission](resource)`, treating an unknown role as "not
|
|
66
|
+
* granted" instead of letting `accesscontrol` throw.
|
|
67
|
+
*
|
|
68
|
+
* `accesscontrol` throws `AccessControlError` ("Role not found") for any role
|
|
69
|
+
* name absent from the grants map, and rejects the WHOLE role array on a
|
|
70
|
+
* single unknown member - so `['user', 'reports.read']` throws even for a
|
|
71
|
+
* route that `user` alone fully grants. Uncaught, that surfaced as a 500 with
|
|
72
|
+
* a library stack trace on every request carrying such a role, instead of the
|
|
73
|
+
* policy's own Forbidden. Mirrors the same guard in
|
|
74
|
+
* `packages/rbac/src/middleware.ts` (`RbacModelPermissionMiddleware.context`,
|
|
75
|
+
* around the `ac.can(roles)` calls), which treats the identical throw as "no
|
|
76
|
+
* permission" for the ORM query-builder checks.
|
|
77
|
+
*
|
|
78
|
+
* The catch is narrowed to `AccessControlError` via `AccessControl.isAccessControlError`
|
|
79
|
+
* rather than a bare `catch`, so a genuine programming error - e.g. a decorator typo like
|
|
80
|
+
* `@Permission(['readOwm'])`, which throws `TypeError: ac.can(...).readOwm is not a
|
|
81
|
+
* function` - still propagates as a loud 500 naming the bad method instead of being
|
|
82
|
+
* swallowed into a plausible-looking 403.
|
|
83
|
+
*
|
|
84
|
+
* `AccessControl.isAccessControlError` is used instead of `instanceof AccessControlError`
|
|
85
|
+
* on purpose: `accesscontrol`'s package root (`main` in package.json) only re-exports the
|
|
86
|
+
* `AccessControl` class, not `AccessControlError` - despite the package's own `.d.ts`
|
|
87
|
+
* (`types` in package.json, resolved from a different file than `main`) declaring it as a
|
|
88
|
+
* named export. `import { AccessControlError } from 'accesscontrol'` type-checks but is
|
|
89
|
+
* `undefined` at runtime, which would make `instanceof AccessControlError` throw. The
|
|
90
|
+
* `AccessControl` class itself does not have this split - it is exported correctly at
|
|
91
|
+
* runtime - so its static helper is the reliable way to recognise the error.
|
|
92
|
+
*/
|
|
93
|
+
function _can(ac, roles, permission, resource) {
|
|
94
|
+
try {
|
|
95
|
+
return ac.can(roles)[permission](resource);
|
|
96
|
+
}
|
|
97
|
+
catch (err) {
|
|
98
|
+
if (accesscontrol_1.AccessControl.isAccessControlError(err)) {
|
|
99
|
+
return null;
|
|
100
|
+
}
|
|
101
|
+
throw err;
|
|
102
|
+
}
|
|
103
|
+
}
|
|
63
104
|
function checkRbacPermission(role, resource, permission) {
|
|
64
105
|
const ac = di_1.DI.get('AccessControl');
|
|
65
|
-
return ac
|
|
106
|
+
return _can(ac, role, permission, resource);
|
|
66
107
|
}
|
|
67
108
|
function checkUserPermission(user, resource, permission) {
|
|
68
|
-
const ac = di_1.DI.get('AccessControl');
|
|
69
109
|
if (!user) {
|
|
70
110
|
return null;
|
|
71
111
|
}
|
|
72
|
-
|
|
112
|
+
const ac = di_1.DI.get('AccessControl');
|
|
113
|
+
return _can(ac, user.Role, permission, resource);
|
|
73
114
|
}
|
|
74
115
|
function checkRoutePermission(req, resource, permission) {
|
|
75
116
|
if (!req.storage || !req.storage.User) {
|
|
@@ -77,6 +118,6 @@ function checkRoutePermission(req, resource, permission) {
|
|
|
77
118
|
}
|
|
78
119
|
const ac = di_1.DI.get('AccessControl');
|
|
79
120
|
const roles = req.storage.ActiveRole ? [req.storage.ActiveRole] : req.storage.User.Role;
|
|
80
|
-
return ac
|
|
121
|
+
return _can(ac, roles, permission, resource);
|
|
81
122
|
}
|
|
82
123
|
//# sourceMappingURL=RbacPolicy.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"RbacPolicy.js","sourceRoot":"","sources":["../../../src/policies/RbacPolicy.ts"],"names":[],"mappings":";;;;;;
|
|
1
|
+
{"version":3,"file":"RbacPolicy.js","sourceRoot":"","sources":["../../../src/policies/RbacPolicy.ts"],"names":[],"mappings":";;;;;;AAAA,iDAA0D;AAC1D,wCAAkG;AAClG,oDAAsE;AACtE,oDAA6D;AAE7D,oCAAiC;AAGjC;;GAEG;AACH,gBAAwB,SAAQ,iBAAU;IAGxC;QACE,KAAK,EAAE,CAAC;QAER,IAAI,CAAC,EAAE,GAAG,OAAE,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC;IACrC,CAAC;IAEM,SAAS,CAAC,OAAe,EAAE,SAAsB;QACtD,0BAA0B;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,GAAa,EAAE,MAAc,EAAE,QAAqB;QACvE,MAAM,UAAU,GAAoB,OAAO,CAAC,WAAW,CAAC,yCAAyB,EAAE,QAAQ,CAAC,CAAC;QAE7F,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,mDAAmD;QACnD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,kBAAW,CAAC,2CAA2C,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;QAE7C,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACjD,uEAAuE;YACvE,uEAAuE;YACvE,0EAA0E;YAC1E,qEAAqE;YACrE,0EAA0E;YAC1E,yEAAyE;YACzE,wEAAwE;YACxE,wEAAwE;YACxE,0EAA0E;YAC1E,EAAE;YACF,yEAAyE;YACzE,oEAAoE;YACpE,iGAAiG;YACjG,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAE,CAAC,UAAU,IAAI,EAAE,CAAC;QAC9E,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,kBAAW,CAAC,2CAA2C,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7G,MAAM,IAAI,iCAAoB,CAAC,oCAAoC,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;YACtF,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAClE,MAAM,IAAI,sBAAS,CAAC,WAAW,SAAS,6BAA6B,UAAU,iBAAiB,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzH,CAAC;IACH,CAAC;CACF;;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,SAAS,IAAI,CAAC,EAAiB,EAAE,KAAwB,EAAE,UAAkB,EAAE,QAAgB;IAC7F,IAAI,CAAC;QACH,OAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,6BAAa,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,6BAAoC,IAAuB,EAAE,QAAgB,EAAE,UAAkB;IAC/F,MAAM,EAAE,GAAG,OAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACnD,OAAO,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED,6BAAoC,IAAU,EAAE,QAAgB,EAAE,UAAkB;IAClF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,OAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACnD,OAAO,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,8BAAqC,GAAa,EAAE,QAAgB,EAAE,UAAkB;IACtF,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,OAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;IACxF,OAAO,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AAC/C,CAAC"}
|
|
@@ -10,7 +10,7 @@ export declare class RbacPolicy extends BasePolicy {
|
|
|
10
10
|
isEnabled(_action: IRoute, _instance: IController): boolean;
|
|
11
11
|
execute(req: sRequest, action: IRoute, instance: IController): Promise<void>;
|
|
12
12
|
}
|
|
13
|
-
export declare function checkRbacPermission(role: string | string[], resource: string, permission: string): Permission;
|
|
13
|
+
export declare function checkRbacPermission(role: string | string[], resource: string, permission: string): Permission | null;
|
|
14
14
|
export declare function checkUserPermission(user: User, resource: string, permission: string): Permission | null;
|
|
15
15
|
export declare function checkRoutePermission(req: sRequest, resource: string, permission: string): Permission | null;
|
|
16
16
|
//# sourceMappingURL=RbacPolicy.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"RbacPolicy.d.ts","sourceRoot":"","sources":["../../../src/policies/RbacPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAe,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAKlG,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC;;GAEG;AACH,qBAAa,UAAW,SAAQ,UAAU;IACxC,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B,cAIC;IAEM,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO,CAGjE;IAEY,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,iBA2CxE;CACF;
|
|
1
|
+
{"version":3,"file":"RbacPolicy.d.ts","sourceRoot":"","sources":["../../../src/policies/RbacPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAe,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAKlG,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC;;GAEG;AACH,qBAAa,UAAW,SAAQ,UAAU;IACxC,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B,cAIC;IAEM,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO,CAGjE;IAEY,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,iBA2CxE;CACF;AA2CD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAGpH;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAOvG;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAQ3G"}
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import { AccessControl } from 'accesscontrol';
|
|
1
2
|
import { BasePolicy, ServerError } from '@spinajs/http';
|
|
2
3
|
import { AuthenticationFailed, Forbidden } from '@spinajs/exceptions';
|
|
3
4
|
import { ACL_CONTROLLER_DESCRIPTOR } from '../decorators.js';
|
|
@@ -53,16 +54,56 @@ export class RbacPolicy extends BasePolicy {
|
|
|
53
54
|
}
|
|
54
55
|
}
|
|
55
56
|
}
|
|
57
|
+
/**
|
|
58
|
+
* Runs `ac.can(roles)[permission](resource)`, treating an unknown role as "not
|
|
59
|
+
* granted" instead of letting `accesscontrol` throw.
|
|
60
|
+
*
|
|
61
|
+
* `accesscontrol` throws `AccessControlError` ("Role not found") for any role
|
|
62
|
+
* name absent from the grants map, and rejects the WHOLE role array on a
|
|
63
|
+
* single unknown member - so `['user', 'reports.read']` throws even for a
|
|
64
|
+
* route that `user` alone fully grants. Uncaught, that surfaced as a 500 with
|
|
65
|
+
* a library stack trace on every request carrying such a role, instead of the
|
|
66
|
+
* policy's own Forbidden. Mirrors the same guard in
|
|
67
|
+
* `packages/rbac/src/middleware.ts` (`RbacModelPermissionMiddleware.context`,
|
|
68
|
+
* around the `ac.can(roles)` calls), which treats the identical throw as "no
|
|
69
|
+
* permission" for the ORM query-builder checks.
|
|
70
|
+
*
|
|
71
|
+
* The catch is narrowed to `AccessControlError` via `AccessControl.isAccessControlError`
|
|
72
|
+
* rather than a bare `catch`, so a genuine programming error - e.g. a decorator typo like
|
|
73
|
+
* `@Permission(['readOwm'])`, which throws `TypeError: ac.can(...).readOwm is not a
|
|
74
|
+
* function` - still propagates as a loud 500 naming the bad method instead of being
|
|
75
|
+
* swallowed into a plausible-looking 403.
|
|
76
|
+
*
|
|
77
|
+
* `AccessControl.isAccessControlError` is used instead of `instanceof AccessControlError`
|
|
78
|
+
* on purpose: `accesscontrol`'s package root (`main` in package.json) only re-exports the
|
|
79
|
+
* `AccessControl` class, not `AccessControlError` - despite the package's own `.d.ts`
|
|
80
|
+
* (`types` in package.json, resolved from a different file than `main`) declaring it as a
|
|
81
|
+
* named export. `import { AccessControlError } from 'accesscontrol'` type-checks but is
|
|
82
|
+
* `undefined` at runtime, which would make `instanceof AccessControlError` throw. The
|
|
83
|
+
* `AccessControl` class itself does not have this split - it is exported correctly at
|
|
84
|
+
* runtime - so its static helper is the reliable way to recognise the error.
|
|
85
|
+
*/
|
|
86
|
+
function _can(ac, roles, permission, resource) {
|
|
87
|
+
try {
|
|
88
|
+
return ac.can(roles)[permission](resource);
|
|
89
|
+
}
|
|
90
|
+
catch (err) {
|
|
91
|
+
if (AccessControl.isAccessControlError(err)) {
|
|
92
|
+
return null;
|
|
93
|
+
}
|
|
94
|
+
throw err;
|
|
95
|
+
}
|
|
96
|
+
}
|
|
56
97
|
export function checkRbacPermission(role, resource, permission) {
|
|
57
98
|
const ac = DI.get('AccessControl');
|
|
58
|
-
return ac
|
|
99
|
+
return _can(ac, role, permission, resource);
|
|
59
100
|
}
|
|
60
101
|
export function checkUserPermission(user, resource, permission) {
|
|
61
|
-
const ac = DI.get('AccessControl');
|
|
62
102
|
if (!user) {
|
|
63
103
|
return null;
|
|
64
104
|
}
|
|
65
|
-
|
|
105
|
+
const ac = DI.get('AccessControl');
|
|
106
|
+
return _can(ac, user.Role, permission, resource);
|
|
66
107
|
}
|
|
67
108
|
export function checkRoutePermission(req, resource, permission) {
|
|
68
109
|
if (!req.storage || !req.storage.User) {
|
|
@@ -70,6 +111,6 @@ export function checkRoutePermission(req, resource, permission) {
|
|
|
70
111
|
}
|
|
71
112
|
const ac = DI.get('AccessControl');
|
|
72
113
|
const roles = req.storage.ActiveRole ? [req.storage.ActiveRole] : req.storage.User.Role;
|
|
73
|
-
return ac
|
|
114
|
+
return _can(ac, roles, permission, resource);
|
|
74
115
|
}
|
|
75
116
|
//# sourceMappingURL=RbacPolicy.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"RbacPolicy.js","sourceRoot":"","sources":["../../../src/policies/RbacPolicy.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"RbacPolicy.js","sourceRoot":"","sources":["../../../src/policies/RbacPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAc,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAuB,WAAW,EAAuB,MAAM,eAAe,CAAC;AAClG,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAE7D,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGjC;;GAEG;AACH,MAAM,OAAO,UAAW,SAAQ,UAAU;IAGxC;QACE,KAAK,EAAE,CAAC;QAER,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC;IACrC,CAAC;IAEM,SAAS,CAAC,OAAe,EAAE,SAAsB;QACtD,0BAA0B;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,GAAa,EAAE,MAAc,EAAE,QAAqB;QACvE,MAAM,UAAU,GAAoB,OAAO,CAAC,WAAW,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAE7F,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,mDAAmD;QACnD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,WAAW,CAAC,2CAA2C,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;QAE7C,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACjD,uEAAuE;YACvE,uEAAuE;YACvE,0EAA0E;YAC1E,qEAAqE;YACrE,0EAA0E;YAC1E,yEAAyE;YACzE,wEAAwE;YACxE,wEAAwE;YACxE,0EAA0E;YAC1E,EAAE;YACF,yEAAyE;YACzE,oEAAoE;YACpE,iGAAiG;YACjG,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAE,CAAC,UAAU,IAAI,EAAE,CAAC;QAC9E,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,WAAW,CAAC,2CAA2C,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7G,MAAM,IAAI,oBAAoB,CAAC,oCAAoC,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;YACtF,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAClE,MAAM,IAAI,SAAS,CAAC,WAAW,SAAS,6BAA6B,UAAU,iBAAiB,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzH,CAAC;IACH,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,SAAS,IAAI,CAAC,EAAiB,EAAE,KAAwB,EAAE,UAAkB,EAAE,QAAgB;IAC7F,IAAI,CAAC;QACH,OAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,aAAa,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAuB,EAAE,QAAgB,EAAE,UAAkB;IAC/F,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACnD,OAAO,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAU,EAAE,QAAgB,EAAE,UAAkB;IAClF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACnD,OAAO,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAa,EAAE,QAAgB,EAAE,UAAkB;IACtF,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;IACxF,OAAO,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AAC/C,CAAC"}
|