@spinajs/rbac 2.0.481 → 2.0.482
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/cjs/actions.d.ts.map +1 -1
- package/lib/cjs/actions.js +32 -6
- package/lib/cjs/actions.js.map +1 -1
- package/lib/cjs/cli/ActivateUser.js +1 -1
- package/lib/cjs/cli/ActivateUser.js.map +1 -1
- package/lib/cjs/cli/BanUser.js +1 -1
- package/lib/cjs/cli/BanUser.js.map +1 -1
- package/lib/cjs/config/rbac.d.ts +11 -1
- package/lib/cjs/config/rbac.d.ts.map +1 -1
- package/lib/cjs/config/rbac.js +12 -3
- package/lib/cjs/config/rbac.js.map +1 -1
- package/lib/cjs/cron/DeactivatePasswords.d.ts.map +1 -1
- package/lib/cjs/cron/DeactivatePasswords.js +6 -2
- package/lib/cjs/cron/DeactivatePasswords.js.map +1 -1
- package/lib/cjs/index.d.ts +6 -0
- package/lib/cjs/index.d.ts.map +1 -1
- package/lib/cjs/index.js +6 -0
- package/lib/cjs/index.js.map +1 -1
- package/lib/cjs/interfaces.d.ts +63 -37
- package/lib/cjs/interfaces.d.ts.map +1 -1
- package/lib/cjs/interfaces.js +43 -1
- package/lib/cjs/interfaces.js.map +1 -1
- package/lib/cjs/middleware.d.ts +23 -1
- package/lib/cjs/middleware.d.ts.map +1 -1
- package/lib/cjs/middleware.js +158 -104
- package/lib/cjs/middleware.js.map +1 -1
- package/lib/cjs/models/User.d.ts.map +1 -1
- package/lib/cjs/models/User.js +15 -1
- package/lib/cjs/models/User.js.map +1 -1
- package/lib/cjs/ownership.d.ts +2 -0
- package/lib/cjs/ownership.d.ts.map +1 -0
- package/lib/cjs/ownership.js +46 -0
- package/lib/cjs/ownership.js.map +1 -0
- package/lib/cjs/session-codec.d.ts +15 -0
- package/lib/cjs/session-codec.d.ts.map +1 -0
- package/lib/cjs/session-codec.js +59 -0
- package/lib/cjs/session-codec.js.map +1 -0
- package/lib/cjs/session-expiration.d.ts +40 -0
- package/lib/cjs/session-expiration.d.ts.map +1 -0
- package/lib/cjs/session-expiration.js +93 -0
- package/lib/cjs/session-expiration.js.map +1 -0
- package/lib/cjs/session.d.ts +38 -18
- package/lib/cjs/session.d.ts.map +1 -1
- package/lib/cjs/session.js +91 -50
- package/lib/cjs/session.js.map +1 -1
- package/lib/mjs/actions.d.ts.map +1 -1
- package/lib/mjs/actions.js +32 -6
- package/lib/mjs/actions.js.map +1 -1
- package/lib/mjs/cli/ActivateUser.js +1 -1
- package/lib/mjs/cli/ActivateUser.js.map +1 -1
- package/lib/mjs/cli/BanUser.js +1 -1
- package/lib/mjs/cli/BanUser.js.map +1 -1
- package/lib/mjs/config/rbac.d.ts +11 -1
- package/lib/mjs/config/rbac.d.ts.map +1 -1
- package/lib/mjs/config/rbac.js +12 -3
- package/lib/mjs/config/rbac.js.map +1 -1
- package/lib/mjs/cron/DeactivatePasswords.d.ts.map +1 -1
- package/lib/mjs/cron/DeactivatePasswords.js +6 -2
- package/lib/mjs/cron/DeactivatePasswords.js.map +1 -1
- package/lib/mjs/index.d.ts +6 -0
- package/lib/mjs/index.d.ts.map +1 -1
- package/lib/mjs/index.js +6 -0
- package/lib/mjs/index.js.map +1 -1
- package/lib/mjs/interfaces.d.ts +63 -37
- package/lib/mjs/interfaces.d.ts.map +1 -1
- package/lib/mjs/interfaces.js +41 -0
- package/lib/mjs/interfaces.js.map +1 -1
- package/lib/mjs/middleware.d.ts +23 -1
- package/lib/mjs/middleware.d.ts.map +1 -1
- package/lib/mjs/middleware.js +158 -104
- package/lib/mjs/middleware.js.map +1 -1
- package/lib/mjs/models/User.d.ts.map +1 -1
- package/lib/mjs/models/User.js +15 -1
- package/lib/mjs/models/User.js.map +1 -1
- package/lib/mjs/ownership.d.ts +2 -0
- package/lib/mjs/ownership.d.ts.map +1 -0
- package/lib/mjs/ownership.js +44 -0
- package/lib/mjs/ownership.js.map +1 -0
- package/lib/mjs/session-codec.d.ts +15 -0
- package/lib/mjs/session-codec.d.ts.map +1 -0
- package/lib/mjs/session-codec.js +55 -0
- package/lib/mjs/session-codec.js.map +1 -0
- package/lib/mjs/session-expiration.d.ts +40 -0
- package/lib/mjs/session-expiration.d.ts.map +1 -0
- package/lib/mjs/session-expiration.js +90 -0
- package/lib/mjs/session-expiration.js.map +1 -0
- package/lib/mjs/session.d.ts +38 -18
- package/lib/mjs/session.d.ts.map +1 -1
- package/lib/mjs/session.js +89 -47
- package/lib/mjs/session.js.map +1 -1
- package/lib/tsconfig.cjs.tsbuildinfo +1 -1
- package/lib/tsconfig.mjs.tsbuildinfo +1 -1
- package/package.json +15 -12
package/lib/cjs/interfaces.js
CHANGED
|
@@ -1,7 +1,27 @@
|
|
|
1
1
|
"use strict";
|
|
2
|
+
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
|
|
3
|
+
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
|
|
4
|
+
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
|
|
5
|
+
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
|
|
6
|
+
return c > 3 && r && Object.defineProperty(target, key, r), r;
|
|
7
|
+
};
|
|
8
|
+
var __metadata = (this && this.__metadata) || function (k, v) {
|
|
9
|
+
if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
|
|
10
|
+
};
|
|
2
11
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.UserProfileProvider = exports.UserProfile = exports.PasswordValidationProvider = exports.AthenticationErrorCodes = exports.SessionProvider = exports.FederatedAuthProvider = exports.AuthProvider = exports.PasswordProvider = void 0;
|
|
12
|
+
exports.UserProfileProvider = exports.UserProfile = exports.PasswordValidationProvider = exports.AthenticationErrorCodes = exports.SessionProvider = exports.FederatedAuthProvider = exports.AuthProvider = exports.PasswordProvider = exports.SessionExpirationProvider = void 0;
|
|
4
13
|
const di_1 = require("@spinajs/di");
|
|
14
|
+
const configuration_1 = require("@spinajs/configuration");
|
|
15
|
+
const luxon_1 = require("luxon");
|
|
16
|
+
/**
|
|
17
|
+
* Configurable session expiration strategy. Resolved by config service name at
|
|
18
|
+
* `rbac.session.expiration.service`, mirroring the `rbac.password` pattern.
|
|
19
|
+
*
|
|
20
|
+
* Units for all shipped strategies are MINUTES.
|
|
21
|
+
*/
|
|
22
|
+
class SessionExpirationProvider {
|
|
23
|
+
}
|
|
24
|
+
exports.SessionExpirationProvider = SessionExpirationProvider;
|
|
5
25
|
/**
|
|
6
26
|
* Service used for generating random password & for hash raw string
|
|
7
27
|
*/
|
|
@@ -28,8 +48,30 @@ class FederatedAuthProvider {
|
|
|
28
48
|
}
|
|
29
49
|
exports.FederatedAuthProvider = FederatedAuthProvider;
|
|
30
50
|
class SessionProvider extends di_1.AsyncService {
|
|
51
|
+
/**
|
|
52
|
+
* Sets the initial expiration on a freshly created session.
|
|
53
|
+
*/
|
|
54
|
+
applyInitialExpiration(s) {
|
|
55
|
+
s.Expiration = this.Expiration.initial(s);
|
|
56
|
+
}
|
|
57
|
+
/**
|
|
58
|
+
* Sets the renewed expiration on a session being touched.
|
|
59
|
+
*/
|
|
60
|
+
applyRenewedExpiration(s) {
|
|
61
|
+
s.Expiration = this.Expiration.renew(s);
|
|
62
|
+
}
|
|
63
|
+
/**
|
|
64
|
+
* True when the session carries an expiration in the past.
|
|
65
|
+
*/
|
|
66
|
+
isExpired(s) {
|
|
67
|
+
return !!s.Expiration && s.Expiration <= luxon_1.DateTime.now();
|
|
68
|
+
}
|
|
31
69
|
}
|
|
32
70
|
exports.SessionProvider = SessionProvider;
|
|
71
|
+
__decorate([
|
|
72
|
+
(0, configuration_1.AutoinjectService)('rbac.session.expiration'),
|
|
73
|
+
__metadata("design:type", SessionExpirationProvider)
|
|
74
|
+
], SessionProvider.prototype, "Expiration", void 0);
|
|
33
75
|
var AthenticationErrorCodes;
|
|
34
76
|
(function (AthenticationErrorCodes) {
|
|
35
77
|
AthenticationErrorCodes[AthenticationErrorCodes["E_USER_BANNED"] = 1] = "E_USER_BANNED";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,oCAA2C;AAC3C,0DAA2D;AAE3D,iCAAiC;AAkEjC;;;;;GAKG;AACH,MAAsB,yBAAyB;CAU9C;AAVD,8DAUC;AAED;;GAEG;AACH,MAAsB,gBAAgB;CAsBrC;AAtBD,4CAsBC;AAED;;;;;GAKG;AACH,MAAsB,YAAY;CAgEjC;AAhED,oCAgEC;AAED;;;;;;GAMG;AACH,MAAsB,qBAAqB;CAwB1C;AAxBD,sDAwBC;AAED,MAAsB,eAA+C,SAAQ,iBAAY;IA8DvF;;OAEG;IACO,sBAAsB,CAAC,CAAW;QAC1C,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACO,sBAAsB,CAAC,CAAW;QAC1C,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACO,SAAS,CAAC,CAAW;QAC7B,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,IAAI,gBAAQ,CAAC,GAAG,EAAE,CAAC;IAC1D,CAAC;CACF;AAlFD,0CAkFC;AA3EW;IADT,IAAA,iCAAiB,EAAC,yBAAyB,CAAC;8BACtB,yBAAyB;mDAAC;AA6EnD,IAAY,uBAKX;AALD,WAAY,uBAAuB;IACjC,uFAAiB,CAAA;IACjB,+FAAqB,CAAA;IACrB,uGAAyB,CAAA;IACzB,+GAA6B,CAAA;AAC/B,CAAC,EALW,uBAAuB,uCAAvB,uBAAuB,QAKlC;AAUD;;GAEG;AACH,MAAsB,0BAA0B;CAE/C;AAFD,gEAEC;AAGD,MAAa,WAAW;IAItB,YAAmB,IAAW,EAAE,IAAU;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;CACF;AARD,kCAQC;AAED;;;;;GAKG;AACH,MAAsB,mBAAmB;CAExC;AAFD,kDAEC"}
|
package/lib/cjs/middleware.d.ts
CHANGED
|
@@ -1,10 +1,32 @@
|
|
|
1
1
|
import { QueryBuilder, QueryMiddleware } from '@spinajs/orm';
|
|
2
|
+
import { IRbacModelDescriptor } from './interfaces.js';
|
|
2
3
|
import { AccessControl } from 'accesscontrol';
|
|
3
4
|
import { Log } from '@spinajs/log-common';
|
|
4
5
|
export declare class RbacModelPermissionMiddleware extends QueryMiddleware {
|
|
5
6
|
protected Log: Log;
|
|
6
7
|
protected Ac: AccessControl;
|
|
7
|
-
|
|
8
|
+
/**
|
|
9
|
+
* INSERT is enforced here rather than in `afterQueryCreation` because the row payload does
|
|
10
|
+
* not exist at construction time — `values()` is called afterwards and would overwrite an
|
|
11
|
+
* owner column stamped earlier. Reads and writes keep their where-clause injection at
|
|
12
|
+
* construction, where it has always been.
|
|
13
|
+
*/
|
|
14
|
+
beforeQueryExecution(builder: QueryBuilder<any>): void;
|
|
8
15
|
afterQueryCreation(builder: QueryBuilder): void;
|
|
16
|
+
/**
|
|
17
|
+
* Everything both hooks need, or `undefined` when this query is not subject to a check.
|
|
18
|
+
*
|
|
19
|
+
* Shared so the two hooks cannot drift on who is exempt: no async context, no user, an
|
|
20
|
+
* explicit skip flag, a model with no `@Resource()`, or a declared `PermissionScope` that
|
|
21
|
+
* does not match this builder type.
|
|
22
|
+
*/
|
|
23
|
+
protected context(builder: QueryBuilder): {
|
|
24
|
+
descriptor: IRbacModelDescriptor;
|
|
25
|
+
resource: string;
|
|
26
|
+
canOwn: boolean;
|
|
27
|
+
canAny: boolean;
|
|
28
|
+
action: string;
|
|
29
|
+
user: import("./index.js").User;
|
|
30
|
+
} | undefined;
|
|
9
31
|
}
|
|
10
32
|
//# sourceMappingURL=middleware.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAgF,YAAY,EAAE,eAAe,EAA0C,MAAM,cAAc,CAAC;
|
|
1
|
+
{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAgF,YAAY,EAAE,eAAe,EAA0C,MAAM,cAAc,CAAC;AAEnL,OAAO,EAAqB,oBAAoB,EAAkB,MAAM,iBAAiB,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,EAAE,GAAG,EAAU,MAAM,qBAAqB,CAAC;AA4ClD,qBACa,6BAA8B,SAAQ,eAAe;IAGhE,SAAS,CAAC,GAAG,EAAG,GAAG,CAAC;IAGpB,SAAS,CAAC,EAAE,EAAG,aAAa,CAAC;IAE7B;;;;;OAKG;IACH,oBAAoB,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,GAAG,IAAI;IA8BtD,kBAAkB,CAAC,OAAO,EAAE,YAAY;IA6CxC;;;;;;OAMG;IACH,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY;;;;;;;;CAoExC"}
|
package/lib/cjs/middleware.js
CHANGED
|
@@ -16,115 +16,169 @@ const async_hooks_1 = require("async_hooks");
|
|
|
16
16
|
const accesscontrol_1 = require("accesscontrol");
|
|
17
17
|
const exceptions_1 = require("@spinajs/exceptions");
|
|
18
18
|
const log_common_1 = require("@spinajs/log-common");
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
19
|
+
/**
|
|
20
|
+
* Which permission scopes a builder type is checked against.
|
|
21
|
+
*
|
|
22
|
+
* Keyed on the CONSTRUCTOR, not on `constructor.name`. A name-keyed lookup breaks under
|
|
23
|
+
* minification and silently yields "no mapping" — for a security check that means an
|
|
24
|
+
* unguarded query, which is why `IdentityMap` rejects name keys for the same reason (A9).
|
|
25
|
+
*
|
|
26
|
+
* `InsertQueryBuilder` was missing here while `PERMISSION_SCOPE_TO_QUERY` claimed to
|
|
27
|
+
* support `createOwn`/`createAny`, so the insert branch of the middleware could only ever
|
|
28
|
+
* have thrown a TypeError. The inverse map below is now DERIVED from this one, so the two
|
|
29
|
+
* cannot drift apart again.
|
|
30
|
+
*/
|
|
31
|
+
const QUERY_TO_PERMISSION = new Map([
|
|
32
|
+
[orm_1.DeleteQueryBuilder, { own: 'deleteOwn', all: 'deleteAny' }],
|
|
33
|
+
[orm_1.UpdateQueryBuilder, { own: 'updateOwn', all: 'updateAny' }],
|
|
34
|
+
[orm_1.SelectQueryBuilder, { own: 'readOwn', all: 'readAny' }],
|
|
35
|
+
[orm_1.InsertQueryBuilder, { own: 'createOwn', all: 'createAny' }],
|
|
36
|
+
]);
|
|
37
|
+
/** Derived inverse of {@link QUERY_TO_PERMISSION}. Never hand-maintained. */
|
|
38
|
+
const PERMISSION_SCOPE_TO_QUERY = new Map();
|
|
39
|
+
for (const [ctor, scopes] of QUERY_TO_PERMISSION) {
|
|
40
|
+
PERMISSION_SCOPE_TO_QUERY.set(scopes.own, ctor);
|
|
41
|
+
PERMISSION_SCOPE_TO_QUERY.set(scopes.all, ctor);
|
|
42
|
+
}
|
|
43
|
+
/**
|
|
44
|
+
* The permission scopes for `builder`, matched by `instanceof` so a driver-specific
|
|
45
|
+
* subclass resolves to its base builder's scopes instead of falling off the map.
|
|
46
|
+
*/
|
|
47
|
+
function permissionsFor(builder) {
|
|
48
|
+
for (const [ctor, scopes] of QUERY_TO_PERMISSION) {
|
|
49
|
+
if (builder instanceof ctor) {
|
|
50
|
+
return scopes;
|
|
51
|
+
}
|
|
31
52
|
}
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
deleteOwn: "DeleteQueryBuilder",
|
|
35
|
-
deleteAny: "DeleteQueryBuilder",
|
|
36
|
-
updateOwn: "UpdateQueryBuilder",
|
|
37
|
-
updateAny: "UpdateQueryBuilder",
|
|
38
|
-
readOwn: "SelectQueryBuilder",
|
|
39
|
-
readAny: "SelectQueryBuilder",
|
|
40
|
-
createOwn: "InsertQueryBuilder",
|
|
41
|
-
createAny: "InsertQueryBuilder"
|
|
42
|
-
};
|
|
53
|
+
return undefined;
|
|
54
|
+
}
|
|
43
55
|
let RbacModelPermissionMiddleware = class RbacModelPermissionMiddleware extends orm_1.QueryMiddleware {
|
|
44
|
-
|
|
56
|
+
/**
|
|
57
|
+
* INSERT is enforced here rather than in `afterQueryCreation` because the row payload does
|
|
58
|
+
* not exist at construction time — `values()` is called afterwards and would overwrite an
|
|
59
|
+
* owner column stamped earlier. Reads and writes keep their where-clause injection at
|
|
60
|
+
* construction, where it has always been.
|
|
61
|
+
*/
|
|
62
|
+
beforeQueryExecution(builder) {
|
|
63
|
+
if (!(builder instanceof orm_1.InsertQueryBuilder)) {
|
|
64
|
+
return;
|
|
65
|
+
}
|
|
66
|
+
const context = this.context(builder);
|
|
67
|
+
if (!context) {
|
|
68
|
+
return;
|
|
69
|
+
}
|
|
70
|
+
const { descriptor, resource, canOwn, canAny } = context;
|
|
71
|
+
if (canAny) {
|
|
72
|
+
this.Log.trace(`Resource ${resource}:any insert permission granted`);
|
|
73
|
+
return;
|
|
74
|
+
}
|
|
75
|
+
if (!canOwn) {
|
|
76
|
+
throw new exceptions_1.Forbidden(`User does not have permission to access ${resource}:${context.action} permission`);
|
|
77
|
+
}
|
|
78
|
+
if (!descriptor.OwnerField) {
|
|
79
|
+
this.Log.error(`Model ${descriptor.Name} does not have OwnerField set, cannot apply :own permission`);
|
|
80
|
+
throw new orm_1.OrmException(`Model ${descriptor.Name} does not have OwnerField set, cannot apply :own permission`);
|
|
81
|
+
}
|
|
82
|
+
// Overwrite, never merge: a caller-supplied owner id is exactly the IDOR this closes.
|
|
83
|
+
builder.forceColumn(descriptor.OwnerField, context.user.PrimaryKeyValue);
|
|
84
|
+
}
|
|
45
85
|
afterQueryCreation(builder) {
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
[descriptor.OwnerField]: storage.User.PrimaryKeyValue
|
|
119
|
-
});
|
|
120
|
-
}
|
|
121
|
-
else if (!canAny) {
|
|
122
|
-
throw new exceptions_1.Forbidden(`User does not have permission to access ${resource}:insert permission`);
|
|
123
|
-
}
|
|
124
|
-
}
|
|
125
|
-
}
|
|
86
|
+
// Insert is handled at execution time; anything else without a WHERE clause to constrain
|
|
87
|
+
// is not something this middleware knows how to guard.
|
|
88
|
+
if (!(builder instanceof orm_1.SelectQueryBuilder || builder instanceof orm_1.UpdateQueryBuilder || builder instanceof orm_1.DeleteQueryBuilder)) {
|
|
89
|
+
return;
|
|
90
|
+
}
|
|
91
|
+
const context = this.context(builder);
|
|
92
|
+
if (!context) {
|
|
93
|
+
return;
|
|
94
|
+
}
|
|
95
|
+
const { descriptor, resource, canOwn, canAny } = context;
|
|
96
|
+
if (canAny) {
|
|
97
|
+
this.Log.trace(`Resource ${resource}:any permission granted`);
|
|
98
|
+
return;
|
|
99
|
+
}
|
|
100
|
+
if (!canOwn) {
|
|
101
|
+
throw new exceptions_1.Forbidden(`User does not have permission to access ${resource}:${context.action} permission`);
|
|
102
|
+
}
|
|
103
|
+
this.Log.trace(`Resource ${resource}:own permission granted`);
|
|
104
|
+
/**
|
|
105
|
+
* Model can have custom rbac permission check
|
|
106
|
+
*/
|
|
107
|
+
const rbacFunc = builder.Model?.rbac;
|
|
108
|
+
if (rbacFunc) {
|
|
109
|
+
this.Log.trace(`Applying custom rbac func for ${resource}`);
|
|
110
|
+
rbacFunc.call(builder, context.user);
|
|
111
|
+
return;
|
|
112
|
+
}
|
|
113
|
+
if (!descriptor.OwnerField) {
|
|
114
|
+
this.Log.error(`Model ${descriptor.Name} does not have OwnerField set or static rbac function, cannot apply :own permission`);
|
|
115
|
+
throw new orm_1.OrmException(`Model ${descriptor.Name} does not have OwnerField set, cannot apply :own permission`);
|
|
116
|
+
}
|
|
117
|
+
this.Log.trace(`Applying owner field restriction for ${resource}`);
|
|
118
|
+
builder.andWhere(descriptor.OwnerField, context.user.PrimaryKeyValue);
|
|
119
|
+
}
|
|
120
|
+
/**
|
|
121
|
+
* Everything both hooks need, or `undefined` when this query is not subject to a check.
|
|
122
|
+
*
|
|
123
|
+
* Shared so the two hooks cannot drift on who is exempt: no async context, no user, an
|
|
124
|
+
* explicit skip flag, a model with no `@Resource()`, or a declared `PermissionScope` that
|
|
125
|
+
* does not match this builder type.
|
|
126
|
+
*/
|
|
127
|
+
context(builder) {
|
|
128
|
+
if (typeof async_hooks_1.AsyncLocalStorage !== 'function') {
|
|
129
|
+
return undefined;
|
|
130
|
+
}
|
|
131
|
+
const store = di_1.DI.get(async_hooks_1.AsyncLocalStorage);
|
|
132
|
+
const storage = store?.getStore();
|
|
133
|
+
if (!storage || !storage.User) {
|
|
134
|
+
return undefined;
|
|
135
|
+
}
|
|
136
|
+
if (storage.SkipModelPermissionCheck) {
|
|
137
|
+
this.Log.trace(`Model permission check disabled for current execution context, skipping rbac check`);
|
|
138
|
+
return undefined;
|
|
139
|
+
}
|
|
140
|
+
const descriptor = (0, orm_1.extractModelDescriptor)(builder.Model);
|
|
141
|
+
// if model does not have @Resource() decorator set, no rbac is applied
|
|
142
|
+
const resource = descriptor?.RbacResource;
|
|
143
|
+
if (!resource) {
|
|
144
|
+
return undefined;
|
|
145
|
+
}
|
|
146
|
+
const scopes = permissionsFor(builder);
|
|
147
|
+
if (!scopes) {
|
|
148
|
+
// An unmapped builder type reaching a security middleware means an unguarded query.
|
|
149
|
+
// Fail loudly rather than let it through — the previous code read `.own` off
|
|
150
|
+
// `undefined` here and died with a bare TypeError.
|
|
151
|
+
throw new orm_1.OrmException(`rbac cannot check permissions for query builder ${builder.constructor.name}: no permission mapping registered`);
|
|
152
|
+
}
|
|
153
|
+
if (storage.PermissionScope) {
|
|
154
|
+
const expected = PERMISSION_SCOPE_TO_QUERY.get(storage.PermissionScope);
|
|
155
|
+
if (!expected) {
|
|
156
|
+
this.Log.warn(`Permission scope ${storage.PermissionScope} does not match any query type, skipping rbac check`);
|
|
157
|
+
return undefined;
|
|
126
158
|
}
|
|
159
|
+
if (!(builder instanceof expected)) {
|
|
160
|
+
this.Log.warn(`Permission scope ${storage.PermissionScope} does not match query type ${builder.constructor.name}, skipping rbac check`);
|
|
161
|
+
return undefined;
|
|
162
|
+
}
|
|
163
|
+
}
|
|
164
|
+
const ownScope = storage.PermissionScope ?? scopes.own;
|
|
165
|
+
const anyScope = storage.PermissionScope ?? scopes.all;
|
|
166
|
+
const roles = storage.ActiveRole ? [storage.ActiveRole] : storage.User.Role;
|
|
167
|
+
let canAny = false;
|
|
168
|
+
let canOwn = false;
|
|
169
|
+
try {
|
|
170
|
+
canAny = this.Ac.can(roles)[anyScope](resource).granted;
|
|
171
|
+
canOwn = this.Ac.can(roles)[ownScope](resource).granted;
|
|
172
|
+
}
|
|
173
|
+
catch (err) {
|
|
174
|
+
// accesscontrol throws eg. "Role not found" when role has no grants registered
|
|
175
|
+
// treat as no permission so caller gets Forbidden instead of library error
|
|
176
|
+
this.Log.trace(`Permission check for roles ${roles} on resource ${resource} failed: ${err.message}, treating as no permission`);
|
|
127
177
|
}
|
|
178
|
+
// 'readOwn' -> 'read'. Keeps the Forbidden message accurate per builder type instead of
|
|
179
|
+
// the old hard-coded ':read', which was wrong for updates and deletes.
|
|
180
|
+
const action = anyScope.replace(/(Any|Own)$/, '');
|
|
181
|
+
return { descriptor, resource, canOwn, canAny, action, user: storage.User };
|
|
128
182
|
}
|
|
129
183
|
};
|
|
130
184
|
exports.RbacModelPermissionMiddleware = RbacModelPermissionMiddleware;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAyD;AACzD,sCAAmL;AACnL,6CAAgD;AAEhD,iDAA8C;AAC9C,oDAAgD;AAChD,oDAAkD;
|
|
1
|
+
{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAyD;AACzD,sCAAmL;AACnL,6CAAgD;AAEhD,iDAA8C;AAC9C,oDAAgD;AAChD,oDAAkD;AAIlD;;;;;;;;;;;GAWG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAiE;IAClG,CAAC,wBAAiD,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;IAC3F,CAAC,wBAAiD,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;IAC3F,CAAC,wBAAiD,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;IACvF,CAAC,wBAAiD,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;CAC5F,CAAC,CAAC;AAEH,6EAA6E;AAC7E,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAoC,CAAC;AAC9E,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,mBAAmB,EAAE,CAAC;IACjD,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAChD,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,OAAqB;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,mBAAmB,EAAE,CAAC;QACjD,IAAI,OAAO,YAAY,IAAI,EAAE,CAAC;YAC5B,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAGM,IAAM,6BAA6B,GAAnC,MAAM,6BAA8B,SAAQ,qBAAe;IAQhE;;;;;OAKG;IACH,oBAAoB,CAAC,OAA0B;QAC7C,IAAI,CAAC,CAAC,OAAO,YAAY,wBAAkB,CAAC,EAAE,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAEzD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,QAAQ,gCAAgC,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,sBAAS,CAAC,2CAA2C,QAAQ,IAAI,OAAO,CAAC,MAAM,aAAa,CAAC,CAAC;QAC1G,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,UAAU,CAAC,IAAI,6DAA6D,CAAC,CAAC;YACtG,MAAM,IAAI,kBAAY,CAAC,SAAS,UAAU,CAAC,IAAI,6DAA6D,CAAC,CAAC;QAChH,CAAC;QAED,sFAAsF;QACtF,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3E,CAAC;IAED,kBAAkB,CAAC,OAAqB;QACtC,yFAAyF;QACzF,uDAAuD;QACvD,IAAI,CAAC,CAAC,OAAO,YAAY,wBAAkB,IAAI,OAAO,YAAY,wBAAkB,IAAI,OAAO,YAAY,wBAAkB,CAAC,EAAE,CAAC;YAC/H,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAEzD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,QAAQ,yBAAyB,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,sBAAS,CAAC,2CAA2C,QAAQ,IAAI,OAAO,CAAC,MAAM,aAAa,CAAC,CAAC;QAC1G,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,QAAQ,yBAAyB,CAAC,CAAC;QAE9D;;WAEG;QACH,MAAM,QAAQ,GAAI,OAAO,CAAC,KAAa,EAAE,IAAgB,CAAC;QAE1D,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,iCAAiC,QAAQ,EAAE,CAAC,CAAC;YAC5D,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,UAAU,CAAC,IAAI,qFAAqF,CAAC,CAAC;YAC9H,MAAM,IAAI,kBAAY,CAAC,SAAS,UAAU,CAAC,IAAI,6DAA6D,CAAC,CAAC;QAChH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,wCAAwC,QAAQ,EAAE,CAAC,CAAC;QACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;OAMG;IACO,OAAO,CAAC,OAAqB;QACrC,IAAI,OAAO,+BAAiB,KAAK,UAAU,EAAE,CAAC;YAC5C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,KAAK,GAAG,OAAE,CAAC,GAAG,CAAC,+BAAiB,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,KAAK,EAAE,QAAQ,EAAmC,CAAC;QAEnE,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,CAAC,wBAAwB,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,oFAAoF,CAAC,CAAC;YACrG,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,4BAAsB,EAAC,OAAO,CAAC,KAAK,CAAyB,CAAC;QAEjF,uEAAuE;QACvE,MAAM,QAAQ,GAAG,UAAU,EAAE,YAAY,CAAC;QAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,oFAAoF;YACpF,6EAA6E;YAC7E,mDAAmD;YACnD,MAAM,IAAI,kBAAY,CAAC,mDAAmD,OAAO,CAAC,WAAW,CAAC,IAAI,oCAAoC,CAAC,CAAC;QAC1I,CAAC;QAED,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAExE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,eAAe,qDAAqD,CAAC,CAAC;gBAChH,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,IAAI,CAAC,CAAC,OAAO,YAAY,QAAQ,CAAC,EAAE,CAAC;gBACnC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,eAAe,8BAA+B,OAAwB,CAAC,WAAW,CAAC,IAAI,uBAAuB,CAAC,CAAC;gBAC1J,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,IAAI,MAAM,CAAC,GAAG,CAAC;QACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,IAAI,MAAM,CAAC,GAAG,CAAC;QACvD,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAE5E,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAI,IAAI,CAAC,EAAG,CAAC,GAAG,CAAC,KAAK,CAAS,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YAClE,MAAM,GAAI,IAAI,CAAC,EAAG,CAAC,GAAG,CAAC,KAAK,CAAS,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;QACpE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,+EAA+E;YAC/E,2EAA2E;YAC3E,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,8BAA8B,KAAK,gBAAgB,QAAQ,YAAa,GAAa,CAAC,OAAO,6BAA6B,CAAC,CAAC;QAC7I,CAAC;QAED,wFAAwF;QACxF,uEAAuE;QACvE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAElD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9E,CAAC;CACF,CAAA;AApKY,sEAA6B;AAG9B;IADT,IAAA,mBAAM,EAAC,MAAM,CAAC;8BACC,gBAAG;0DAAC;AAGV;IADT,IAAA,eAAU,GAAE;8BACE,6BAAa;yDAAC;wCANlB,6BAA6B;IADzC,IAAA,eAAU,EAAC,qBAAe,CAAC;GACf,6BAA6B,CAoKzC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"User.d.ts","sourceRoot":"","sources":["../../../src/models/User.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAW,SAAS,EAAmF,UAAU,EAAE,mBAAmB,EAAE,gBAAgB,EAAY,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAC9O,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE1D,OAAO,EAAgB,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAMnE,qBAAa,eAAgB,YAAW,UAAU;IAEhD;;;;;;OAMG;IACI,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE;IAKpF;;;;;;;OAOG;IACI,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG;IAU1F,SAAS,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,WAAW,EAAE,IAAI,GAAG,MAAM;IAMnF,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe;IAejE,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe;IAKvE,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe;IAMrE;;;;OAIG;IACI,YAAY,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe;IAOhE,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,KAAK,EAAE,MAAM;IAQ7E,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,KAAK,EAAE,MAAM;IAQ7E,SAAS,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,IAAI,EAAE,MAAM;IAQlF;;;;;;;;;OASG;IACI,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;CAa7G;AAED;;GAEG;AACH,oBAAY,oBAAoB;IAC9B,6BAA6B;IAC7B,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,iBAAiB,sBAAsB;IACvC,eAAe,oBAAoB;IAEnC,wBAAwB;IAExB,WAAW,gBAAgB;IAC3B,UAAU,eAAe;IACzB,uBAAuB,4BAA4B;IAEnD,gBAAgB;IAEhB,cAAc,mBAAmB;IAEjC,qBAAqB;IAGrB,cAAc,mBAAmB;IAEjC,yBAAyB,8BAA8B;IAEvD,wBAAwB,6BAA6B;IAErD,oBAAoB,yBAAyB;IAE7C,2BAA2B,gCAAgC;CAC5D;AAED;;;;GAIG;AACH,qBAEa,QAAS,SAAQ,SAAS,CAAC,QAAQ,CAAC;IAC/C;;;;OAIG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,CAAsB;IAEjD,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC;IAE7B,gBAAuB,YAAY,EAAE,eAAe,CAAyB;gBAE1D,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC;IAUhC,EAAE,EAAG,MAAM,CAAC;IAEZ,IAAI,EAAG,MAAM,CAAC;IAEd,KAAK,EAAG,MAAM,CAAC;IAEtB;;OAEG;IACI,QAAQ,EAAG,MAAM,CAAC;IAEzB;;OAEG;IACI,KAAK,EAAG,MAAM,CAAC;IAEtB;;OAEG;IAEI,IAAI,EAAG,MAAM,EAAE,CAAC;IAEvB;;OAEG;IAEI,SAAS,EAAG,QAAQ,CAAC;IAE5B;;OAEG;IAEI,YAAY,EAAG,QAAQ,CAAC;IAE/B;;OAEG;IAEI,SAAS,EAAG,QAAQ,CAAC;IAGrB,WAAW,EAAG,QAAQ,CAAC;IAE9B;;;OAGG;IACI,QAAQ,EAAG,OAAO,CAAC;IAE1B;;;;;OAKG;IAII,QAAQ,EAAG,gBAAgB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAE3D,IAAW,OAAO,IAAI,OAAO,CAE5B;IAED,IAAW,QAAQ,IAAI,OAAO,
|
|
1
|
+
{"version":3,"file":"User.d.ts","sourceRoot":"","sources":["../../../src/models/User.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAW,SAAS,EAAmF,UAAU,EAAE,mBAAmB,EAAE,gBAAgB,EAAY,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAC9O,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE1D,OAAO,EAAgB,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAMnE,qBAAa,eAAgB,YAAW,UAAU;IAEhD;;;;;;OAMG;IACI,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE;IAKpF;;;;;;;OAOG;IACI,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG;IAU1F,SAAS,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,WAAW,EAAE,IAAI,GAAG,MAAM;IAMnF,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe;IAejE,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe;IAKvE,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe;IAMrE;;;;OAIG;IACI,YAAY,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe;IAOhE,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,KAAK,EAAE,MAAM;IAQ7E,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,KAAK,EAAE,MAAM;IAQ7E,SAAS,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,IAAI,EAAE,MAAM;IAQlF;;;;;;;;;OASG;IACI,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;CAa7G;AAED;;GAEG;AACH,oBAAY,oBAAoB;IAC9B,6BAA6B;IAC7B,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,iBAAiB,sBAAsB;IACvC,eAAe,oBAAoB;IAEnC,wBAAwB;IAExB,WAAW,gBAAgB;IAC3B,UAAU,eAAe;IACzB,uBAAuB,4BAA4B;IAEnD,gBAAgB;IAEhB,cAAc,mBAAmB;IAEjC,qBAAqB;IAGrB,cAAc,mBAAmB;IAEjC,yBAAyB,8BAA8B;IAEvD,wBAAwB,6BAA6B;IAErD,oBAAoB,yBAAyB;IAE7C,2BAA2B,gCAAgC;CAC5D;AAED;;;;GAIG;AACH,qBAEa,QAAS,SAAQ,SAAS,CAAC,QAAQ,CAAC;IAC/C;;;;OAIG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,CAAsB;IAEjD,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC;IAE7B,gBAAuB,YAAY,EAAE,eAAe,CAAyB;gBAE1D,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC;IAUhC,EAAE,EAAG,MAAM,CAAC;IAEZ,IAAI,EAAG,MAAM,CAAC;IAEd,KAAK,EAAG,MAAM,CAAC;IAEtB;;OAEG;IACI,QAAQ,EAAG,MAAM,CAAC;IAEzB;;OAEG;IACI,KAAK,EAAG,MAAM,CAAC;IAEtB;;OAEG;IAEI,IAAI,EAAG,MAAM,EAAE,CAAC;IAEvB;;OAEG;IAEI,SAAS,EAAG,QAAQ,CAAC;IAE5B;;OAEG;IAEI,YAAY,EAAG,QAAQ,CAAC;IAE/B;;OAEG;IAEI,SAAS,EAAG,QAAQ,CAAC;IAGrB,WAAW,EAAG,QAAQ,CAAC;IAE9B;;;OAGG;IACI,QAAQ,EAAG,OAAO,CAAC;IAE1B;;;;;OAKG;IAII,QAAQ,EAAG,gBAAgB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAE3D,IAAW,OAAO,IAAI,OAAO,CAE5B;IAED,IAAW,QAAQ,IAAI,OAAO,CAoB7B;IAEM,sBAAsB,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,yBAAyB,CAAC,IAAI,CAAC;IAcpF,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU;IAO5D;;;;OAIG;IACI,UAAU,CAAC,QAAQ,EAAE,MAAM;IAIlC;;;;;OAKG;IACI,UAAU,CAAC,QAAQ,EAAE,MAAM;IAIlC;;;;;OAKG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;IAIpC;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;IAIpC;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;IAIpC;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;IAIpC;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;IAIpC;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;WAItB,UAAU,CAAC,KAAK,EAAE,MAAM;WAMxB,UAAU,CAAC,KAAK,EAAE,MAAM;WAMxB,SAAS,CAAC,IAAI,EAAE,MAAM;IAMpC;;;;;OAKG;WACW,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;CAGxD;AAED;;GAEG;AACH,qBAEa,IAAK,SAAQ,QAAQ;CAEjC"}
|
package/lib/cjs/models/User.js
CHANGED
|
@@ -168,7 +168,21 @@ let UserBase = UserBase_1 = class UserBase extends orm_1.ModelBase {
|
|
|
168
168
|
return this.Role.indexOf('guest') !== -1 || this.Role.length === 0;
|
|
169
169
|
}
|
|
170
170
|
get IsBanned() {
|
|
171
|
-
|
|
171
|
+
if (this.Metadata[USER_COMMON_METADATA.USER_BAN_IS_BANNED] !== true) {
|
|
172
|
+
return false;
|
|
173
|
+
}
|
|
174
|
+
const start = this.Metadata[USER_COMMON_METADATA.USER_BAN_START_DATE];
|
|
175
|
+
const duration = this.Metadata[USER_COMMON_METADATA.USER_BAN_DURATION];
|
|
176
|
+
// no start/duration recorded -> treat as a permanent ban
|
|
177
|
+
if (!start || duration === null || duration === undefined) {
|
|
178
|
+
return true;
|
|
179
|
+
}
|
|
180
|
+
const startDt = start instanceof luxon_1.DateTime ? start : luxon_1.DateTime.fromISO(String(start));
|
|
181
|
+
if (!startDt.isValid) {
|
|
182
|
+
return true;
|
|
183
|
+
}
|
|
184
|
+
// ban is still active only until start + duration (seconds) elapses
|
|
185
|
+
return startDt.plus({ seconds: Number(duration) }) > luxon_1.DateTime.now();
|
|
172
186
|
}
|
|
173
187
|
dehydrateWithRelations(options) {
|
|
174
188
|
const base = super.dehydrateWithRelations(options);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"User.js","sourceRoot":"","sources":["../../../src/models/User.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,iCAAiC;AACjC,sCAA8O;AAE9O,oCAAiC;AACjC,uDAAmE;AACnE,+BAAoC;AACpC,wCAAwM;AAExM,0DAA8C;AAE9C,MAAa,eAAe;IAE1B;;;;;;OAMG;IACI,QAAQ,CAAsD,KAAe;QAClF,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;OAOG;IACI,aAAa,CAAsD,GAAW,EAAE,KAAU;QAC/F,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,UAAG,EAAC,IAAA,iBAAU,EAAC,IAAA,eAAQ,GAAE,CAAC,EAAE,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjG,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAEjD,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE;YACjC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,SAAS,CAAsD,WAA0B;QAC9F,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,UAAG,EAAC,IAAA,iBAAU,EAAC,IAAA,eAAQ,GAAE,CAAC,EAAE,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAEjH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC;IAEM,KAAK,CAAC,aAAa;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE;aACrC,UAAU,CACT,8BAAY,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC;YACzB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,cAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAC3C,CAAC,CAAC,CACH;aACA,WAAW,EAAE,CAAA;QAGhB,OAAO,MAAM,GAAG,CAAC,CAAC;IACpB,CAAC;IAEM,KAAK,CAAC,aAAa;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/E,OAAO,MAAM,GAAG,CAAC,CAAC;IACpB,CAAC;IAEM,UAAU;QACf,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,SAAS,EAAE,IAAW;SACvB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,YAAY;QACjB,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAW;SACvB,CAAC,CAAC;IACL,CAAC;IAEM,UAAU,CAAsD,KAAa;QAClF,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,EAAE,IAAA,gBAAS,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAEvE,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAEM,UAAU,CAAsD,KAAa;QAClF,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE1D,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAEM,SAAS,CAAsD,IAAY;QAChF,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,eAAQ,GAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAErD,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACI,aAAa,CAA6D,UAA2B;QAC1G,UAAU,GAAG,IAAA,iBAAU,EAAC,IAAA,UAAG,EAAC,IAAA,iBAAU,EAAC,IAAA,UAAG,EAAC,CAAC,CAAC,CAAC,EAAE,IAAA,cAAO,GAAE,EAAE,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAEzH,OAAO,IAAI,CAAC,IAAI,CACd,OAAO,UAAU,KAAK,QAAQ,EAC9B;YACE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC/B,CAAC,EACD;YACE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC3F,CAAC,CACF,CAAC;IACJ,CAAC;CACF;AA3HD,0CA2HC;AAED;;GAEG;AACH,IAAY,oBA6BX;AA7BD,WAAY,oBAAoB;IAC9B,6BAA6B;IAC7B,iEAAyC,CAAA;IACzC,mEAA2C,CAAA;IAC3C,+DAAuC,CAAA;IACvC,2DAAmC,CAAA;IAEnC,wBAAwB;IAExB,mDAA2B,CAAA;IAC3B,iDAAyB,CAAA;IACzB,2EAAmD,CAAA;IAEnD,gBAAgB;IAEhB,yDAAiC,CAAA;IAEjC,qBAAqB;IAErB,gCAAgC;IAChC,yDAAiC,CAAA;IACjC,+BAA+B;IAC/B,+EAAuD,CAAA;IACvD,+BAA+B;IAC/B,6EAAqD,CAAA;IACrD,uBAAuB;IACvB,qEAA6C,CAAA;IAC7C,2CAA2C;IAC3C,mFAA2D,CAAA;AAC7D,CAAC,EA7BW,oBAAoB,oCAApB,oBAAoB,QA6B/B;AAED;;;;GAIG;AAGI,IAAM,QAAQ,gBAAd,MAAM,QAAS,SAAQ,eAAmB;IAY/C,YAAmB,IAAoB;QACrC,KAAK,CAAC,IAAI,CAAC,CAAC;QAZd;;;;WAIG;QACO,YAAO,GAAa,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAS/C,IAAI,CAAC,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,IAAA,SAAM,GAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,CAAC,IAAA,oBAAI,EAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAElF,IAAI,CAAC,GAAG,GAAG,OAAE,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC;IACtC,CAAC;IA+DD,IAAW,OAAO;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;IACrE,CAAC;IAED,IAAW,QAAQ;QACjB,
|
|
1
|
+
{"version":3,"file":"User.js","sourceRoot":"","sources":["../../../src/models/User.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,iCAAiC;AACjC,sCAA8O;AAE9O,oCAAiC;AACjC,uDAAmE;AACnE,+BAAoC;AACpC,wCAAwM;AAExM,0DAA8C;AAE9C,MAAa,eAAe;IAE1B;;;;;;OAMG;IACI,QAAQ,CAAsD,KAAe;QAClF,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;OAOG;IACI,aAAa,CAAsD,GAAW,EAAE,KAAU;QAC/F,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,UAAG,EAAC,IAAA,iBAAU,EAAC,IAAA,eAAQ,GAAE,CAAC,EAAE,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjG,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAEjD,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE;YACjC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,SAAS,CAAsD,WAA0B;QAC9F,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,UAAG,EAAC,IAAA,iBAAU,EAAC,IAAA,eAAQ,GAAE,CAAC,EAAE,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAEjH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC;IAEM,KAAK,CAAC,aAAa;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE;aACrC,UAAU,CACT,8BAAY,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC;YACzB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,cAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAC3C,CAAC,CAAC,CACH;aACA,WAAW,EAAE,CAAA;QAGhB,OAAO,MAAM,GAAG,CAAC,CAAC;IACpB,CAAC;IAEM,KAAK,CAAC,aAAa;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/E,OAAO,MAAM,GAAG,CAAC,CAAC;IACpB,CAAC;IAEM,UAAU;QACf,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,SAAS,EAAE,IAAW;SACvB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,YAAY;QACjB,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAW;SACvB,CAAC,CAAC;IACL,CAAC;IAEM,UAAU,CAAsD,KAAa;QAClF,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,EAAE,IAAA,gBAAS,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAEvE,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAEM,UAAU,CAAsD,KAAa;QAClF,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE1D,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAEM,SAAS,CAAsD,IAAY;QAChF,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,eAAQ,GAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAErD,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACI,aAAa,CAA6D,UAA2B;QAC1G,UAAU,GAAG,IAAA,iBAAU,EAAC,IAAA,UAAG,EAAC,IAAA,iBAAU,EAAC,IAAA,UAAG,EAAC,CAAC,CAAC,CAAC,EAAE,IAAA,cAAO,GAAE,EAAE,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAEzH,OAAO,IAAI,CAAC,IAAI,CACd,OAAO,UAAU,KAAK,QAAQ,EAC9B;YACE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC/B,CAAC,EACD;YACE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC3F,CAAC,CACF,CAAC;IACJ,CAAC;CACF;AA3HD,0CA2HC;AAED;;GAEG;AACH,IAAY,oBA6BX;AA7BD,WAAY,oBAAoB;IAC9B,6BAA6B;IAC7B,iEAAyC,CAAA;IACzC,mEAA2C,CAAA;IAC3C,+DAAuC,CAAA;IACvC,2DAAmC,CAAA;IAEnC,wBAAwB;IAExB,mDAA2B,CAAA;IAC3B,iDAAyB,CAAA;IACzB,2EAAmD,CAAA;IAEnD,gBAAgB;IAEhB,yDAAiC,CAAA;IAEjC,qBAAqB;IAErB,gCAAgC;IAChC,yDAAiC,CAAA;IACjC,+BAA+B;IAC/B,+EAAuD,CAAA;IACvD,+BAA+B;IAC/B,6EAAqD,CAAA;IACrD,uBAAuB;IACvB,qEAA6C,CAAA;IAC7C,2CAA2C;IAC3C,mFAA2D,CAAA;AAC7D,CAAC,EA7BW,oBAAoB,oCAApB,oBAAoB,QA6B/B;AAED;;;;GAIG;AAGI,IAAM,QAAQ,gBAAd,MAAM,QAAS,SAAQ,eAAmB;IAY/C,YAAmB,IAAoB;QACrC,KAAK,CAAC,IAAI,CAAC,CAAC;QAZd;;;;WAIG;QACO,YAAO,GAAa,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAS/C,IAAI,CAAC,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,IAAA,SAAM,GAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,CAAC,IAAA,oBAAI,EAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAElF,IAAI,CAAC,GAAG,GAAG,OAAE,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC;IACtC,CAAC;IA+DD,IAAW,OAAO;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;IACrE,CAAC;IAED,IAAW,QAAQ;QACjB,IAAI,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE,CAAC;YACpE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;QAEvE,yDAAyD;QACzD,IAAI,CAAC,KAAK,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,YAAY,gBAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,oEAAoE;QACpE,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,gBAAQ,CAAC,GAAG,EAAE,CAAC;IACtE,CAAC;IAEM,sBAAsB,CAAC,OAA2B;QAEvD,MAAM,IAAI,GAAG,KAAK,CAAC,sBAAsB,CAAC,OAAO,CAA+C,CAAA;QAEhG;;WAEG;QACH,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,kCAAgB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAQ,CAAA;QACjG,CAAC;QAED,OAAO,IAAW,CAAC;IACrB,CAAC;IAEM,GAAG,CAAC,QAAgB,EAAE,UAAkB;QAC7C,QAAQ,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACnE,UAAU,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAEzE,OAAQ,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC;IAED;;;;OAIG;IACI,UAAU,CAAC,QAAgB;QAChC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACI,UAAU,CAAC,QAAgB;QAChC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAEM,MAAM,CAAC,UAAU,CAAC,KAAa;QACpC,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE1D,OAAO,UAAQ,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IAEM,MAAM,CAAC,UAAU,CAAC,KAAa;QACpC,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,EAAE,IAAA,gBAAS,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAEvE,OAAO,UAAQ,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IAEM,MAAM,CAAC,SAAS,CAAC,IAAY;QAClC,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,eAAQ,GAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAErD,OAAO,UAAQ,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,aAAa,CAAC,UAA2B;QACrD,OAAO,UAAQ,CAAC,KAAK,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;IAC5D,CAAC;;AArOU,4BAAQ;AAUI,qBAAY,GAAoB,IAAI,eAAe,EAAE,AAAzC,CAA0C;AAYtE;IADN,IAAA,aAAO,GAAE;;oCACS;AAoBZ;IADN,IAAA,SAAG,GAAE;;sCACiB;AAMhB;IADN,IAAA,eAAS,GAAE;8BACO,gBAAQ;2CAAC;AAMrB;IADN,IAAA,cAAE,GAAE;8BACiB,gBAAQ;8CAAC;AAMxB;IADN,IAAA,gBAAU,GAAE;8BACM,gBAAQ;2CAAC;AAGrB;IADN,IAAA,cAAE,GAAE;8BACgB,gBAAQ;6CAAC;AAiBvB;IAHN,IAAA,aAAO,EAAC,kCAAgB,EAAE;QACzB,UAAU,EAAE,SAAS;KACtB,CAAC;8BACgB,sBAAgB;0CAAyB;mBAhFhD,QAAQ;IAFpB,IAAA,gBAAU,EAAC,SAAS,CAAC;IACrB,IAAA,WAAK,EAAC,OAAO,CAAC;;GACF,QAAQ,CAsOpB;AAED;;GAEG;AAGI,IAAM,IAAI,GAAV,MAAM,IAAK,SAAQ,QAAQ;CAEjC,CAAA;AAFY,oBAAI;eAAJ,IAAI;IAFhB,IAAA,gBAAU,EAAC,SAAS,CAAC;IACrB,IAAA,WAAK,EAAC,OAAO,CAAC;GACF,IAAI,CAEhB"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../../src/ownership.ts"],"names":[],"mappings":""}
|
|
@@ -0,0 +1,46 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
const orm_1 = require("@spinajs/orm");
|
|
4
|
+
/**
|
|
5
|
+
* Implementation of the ownership helpers declared on `IModelStatic` in
|
|
6
|
+
* `interfaces.ts`. They were previously declared but never implemented, so any
|
|
7
|
+
* call to `Model.ensureOwnership` / `Model.checkOwnership` threw
|
|
8
|
+
* "not a function". They are attached to `ModelBase` so every model gets them.
|
|
9
|
+
*
|
|
10
|
+
* A model participates in ownership checks by decorating its owner column with
|
|
11
|
+
* `@ResourceOwner()`, which sets `OwnerField` on the model descriptor.
|
|
12
|
+
*/
|
|
13
|
+
function rbacDescriptor(model) {
|
|
14
|
+
const descriptor = (0, orm_1.extractModelDescriptor)(model);
|
|
15
|
+
if (!descriptor || !descriptor.OwnerField) {
|
|
16
|
+
const name = descriptor?.Name ?? model?.name;
|
|
17
|
+
throw new orm_1.OrmException(`Model ${name} does not have an @ResourceOwner() field, cannot check ownership`);
|
|
18
|
+
}
|
|
19
|
+
return descriptor;
|
|
20
|
+
}
|
|
21
|
+
/**
|
|
22
|
+
* Alters a query so it only returns/updates/deletes rows owned by `user`.
|
|
23
|
+
*/
|
|
24
|
+
orm_1.ModelBase.ensureOwnership = function (query, user) {
|
|
25
|
+
const descriptor = rbacDescriptor(this);
|
|
26
|
+
return query.where(descriptor.OwnerField, user.PrimaryKeyValue);
|
|
27
|
+
};
|
|
28
|
+
/**
|
|
29
|
+
* Checks whether a model (or its primary key) is owned by `user`.
|
|
30
|
+
* When passed a loaded model the owner column is compared in memory; when
|
|
31
|
+
* passed a primary key the ownership is verified with a scoped DB query.
|
|
32
|
+
*/
|
|
33
|
+
orm_1.ModelBase.checkOwnership = async function (modelOrPrimaryKey, user) {
|
|
34
|
+
const descriptor = rbacDescriptor(this);
|
|
35
|
+
if (modelOrPrimaryKey instanceof orm_1.ModelBase) {
|
|
36
|
+
return modelOrPrimaryKey[descriptor.OwnerField] === user.PrimaryKeyValue;
|
|
37
|
+
}
|
|
38
|
+
// `descriptor.PrimaryKey` is a string[] since the composite-key refactor, so it cannot be
|
|
39
|
+
// handed to `where()` as a column name — that took the whereObject path and filtered on
|
|
40
|
+
// nothing. `wherePk` is the ORM's single home for key predicates and handles both shapes.
|
|
41
|
+
const query = this.query();
|
|
42
|
+
(0, orm_1.wherePk)(query, descriptor, modelOrPrimaryKey);
|
|
43
|
+
const found = await query.where(descriptor.OwnerField, user.PrimaryKeyValue).first();
|
|
44
|
+
return found !== undefined && found !== null;
|
|
45
|
+
};
|
|
46
|
+
//# sourceMappingURL=ownership.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"ownership.js","sourceRoot":"","sources":["../../src/ownership.ts"],"names":[],"mappings":";;AAAA,sCAAsK;AAItK;;;;;;;;GAQG;AAEH,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,UAAU,GAAG,IAAA,4BAAsB,EAAC,KAAY,CAAyB,CAAC;IAEhF,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,UAAU,EAAE,IAAI,IAAK,KAAa,EAAE,IAAI,CAAC;QACtD,MAAM,IAAI,kBAAY,CAAC,SAAS,IAAI,kEAAkE,CAAC,CAAC;IAC1G,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACF,eAAqD,CAAC,eAAe,GAAG,UAEvE,KAAqF,EACrF,IAAU;IAEV,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACxC,OAAQ,KAAa,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;AAC3E,CAAC,CAAC;AAEF;;;;GAIG;AACF,eAAoD,CAAC,cAAc,GAAG,KAAK,WAE1E,iBAAmD,EACnD,IAAU;IAEV,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAExC,IAAI,iBAAiB,YAAY,eAAS,EAAE,CAAC;QAC3C,OAAQ,iBAAyB,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,eAAe,CAAC;IACpF,CAAC;IAED,0FAA0F;IAC1F,wFAAwF;IACxF,0FAA0F;IAC1F,MAAM,KAAK,GAAI,IAAY,CAAC,KAAK,EAAE,CAAC;IACpC,IAAA,aAAO,EAAC,KAAK,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;IAE9C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,EAAE,CAAC;IAErF,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AAC/C,CAAC,CAAC"}
|
|
@@ -0,0 +1,15 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Serializes a session `Data` map to a JSON string, preserving `Map` / `Set` /
|
|
3
|
+
* `DateTime` values.
|
|
4
|
+
*
|
|
5
|
+
* @param data - the session data map
|
|
6
|
+
*/
|
|
7
|
+
export declare function encodeSessionData(data: Map<string, unknown>): string;
|
|
8
|
+
/**
|
|
9
|
+
* Restores a session `Data` map from a JSON string produced by
|
|
10
|
+
* {@link encodeSessionData}.
|
|
11
|
+
*
|
|
12
|
+
* @param json - the serialized session data
|
|
13
|
+
*/
|
|
14
|
+
export declare function decodeSessionData(json: string): Map<string, unknown>;
|
|
15
|
+
//# sourceMappingURL=session-codec.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"session-codec.d.ts","sourceRoot":"","sources":["../../src/session-codec.ts"],"names":[],"mappings":"AAwCA;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAGpE"}
|