@stonecrop/casl-middleware 0.30.0 → 0.32.0

package/dist/src/middleware/yoga.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"yoga.d.ts","sourceRoot":"","sources":["../../../src/middleware/yoga.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAG1C,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAO1D,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,OAAO,CAO1C,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,GAAI,WAAU,iBAAsB;mBAE1C,GAAG;CAMzB,CAAA"}

package/dist/src/middleware/yoga.js

@@ -1,30 +0,0 @@
-import { createAbility } from './ability';
-const getLoggedInUser = () => {
-    // Mock user for demonstration purposes
-    return { id: '1', roles: ['editor'] };
-};
-export const yogaCaslPlugin = {
-    onContextBuilding: async ({ extendContext }) => {
-        // Make this async
-        const user = getLoggedInUser();
-        const ability = await createAbility(user); // Await here
-        extendContext({ ability, user });
-    },
-};
-/**
- * Create a GraphQL Yoga plugin for CASL authorization
- * Note: This is a placeholder for future implementation
- *
- * @param options - CASL middleware configuration options
- * @returns Yoga plugin
- * @public
- */
-export const createYogaPlugin = (_options = {}) => {
-    return {
-        onExecute: async (_) => {
-            // TODO: Implement Yoga plugin via createCaslMiddleware(_options).
-            // This would integrate with GraphQL Yoga's plugin system.
-            console.warn('Yoga plugin not yet implemented');
-        },
-    };
-};

package/dist/src/types/index.d.ts

@@ -1,114 +0,0 @@
-import { GraphQLResolveInfo } from 'graphql';
-import type { AppAbility, AbilityBuilderFunction } from '../middleware/ability';
-/**
- * User information for authorization
- * @public
- */
-export interface User {
-    /** Unique identifier for the user */
-    id: string;
-    /** Array of role names assigned to the user */
-    roles?: string[];
-    /** Additional user properties */
-    [key: string]: any;
-}
-/**
- * GraphQL context with CASL ability and user information
- * @public
- */
-export interface Context {
-    /** CASL ability instance for authorization checks */
-    ability?: AppAbility;
-    /** Current authenticated user */
-    user?: User;
-    /** Additional context properties */
-    [key: string]: any;
-}
-/**
- * Configuration options for CASL middleware
- * @public
- */
-export interface MiddlewareOptions {
-    /** Mapping of GraphQL types to authorization subjects */
-    subjectMap?: Record<string, string>;
-    /** Mapping of GraphQL operations to CASL actions */
-    actionMap?: Record<string, string>;
-    /** Field-level permission rules */
-    fieldPermissions?: Record<string, FieldPermission[]>;
-    /** Custom function to build user abilities */
-    abilityBuilder?: AbilityBuilderFunction;
-    /** Enable debug logging */
-    debug?: boolean;
-}
-/**
- * Field-level permission definition for fine-grained access control
- * @public
- */
-export interface FieldPermission {
-    /** CASL action (e.g., 'read', 'write') */
-    action: string;
-    /** Subject/resource type to apply permission to */
-    subject: string;
-    /** Specific field name (optional) */
-    field?: string;
-    /** Conditional rules for permission */
-    conditions?: any;
-}
-/**
- * GraphQL resolver function type
- * @public
- */
-export type ResolverFn = (root: any, args: any, context: Context, info: GraphQLResolveInfo) => any;
-/**
- * Middleware function that wraps a GraphQL resolver with authorization logic
- * @public
- */
-export type MiddlewareFn = (resolve: ResolverFn, root: any, args: any, context: Context, info: GraphQLResolveInfo) => any;
-/**
- * Plugin configuration options for framework integrations
- * @public
- */
-export interface PluginOptions extends MiddlewareOptions {
-    /** Custom function to build user abilities */
-    abilityBuilder?: AbilityBuilderFunction;
-    /** Ability caching configuration */
-    cacheOptions?: {
-        /** Time-to-live in milliseconds */
-        ttl?: number;
-        /** Function to generate cache key from user */
-        key?: (user?: User) => string;
-    };
-}
-/**
- * Response type for ability creation mutations
- * @public
- */
-export interface AbilityResponse {
-    /** Whether the ability was created successfully */
-    success: boolean;
-    /** The created ability rules */
-    ability: any;
-    /** Success or error message */
-    message: string;
-}
-/**
- * Input type for creating a new ability
- * @public
- */
-export interface CreateAbilityInput {
-    /** User ID to create ability for */
-    userId: string;
-    /** Array of role names to assign */
-    roles: string[];
-}
-export interface AbilityRule {
-    id?: string;
-    roleId?: string;
-    userId?: string;
-    action: string | string[];
-    subject: string;
-    fields?: string[];
-    conditions?: any;
-    inverted?: boolean;
-}
-//# sourceMappingURL=index.d.ts.map

package/dist/src/types/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAE5C,OAAO,KAAK,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAE/E;;;GAGG;AACH,MAAM,WAAW,IAAI;IACpB,qCAAqC;IACrC,EAAE,EAAE,MAAM,CAAA;IACV,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,iCAAiC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,OAAO;IACvB,qDAAqD;IACrD,OAAO,CAAC,EAAE,UAAU,CAAA;IACpB,iCAAiC;IACjC,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,oCAAoC;IACpC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAClB;AAID;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IACjC,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAClC,mCAAmC;IACnC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAAA;IACpD,8CAA8C;IAC9C,cAAc,CAAC,EAAE,sBAAsB,CAAA;IACvC,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAA;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC/B,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAA;IACd,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAA;IACf,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,uCAAuC;IACvC,UAAU,CAAC,EAAE,GAAG,CAAA;CAChB;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,KAAK,GAAG,CAAA;AAElG;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,CAC1B,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,GAAG,EACT,IAAI,EAAE,GAAG,EACT,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,kBAAkB,KACpB,GAAG,CAAA;AAER;;;GAGG;AACH,MAAM,WAAW,aAAc,SAAQ,iBAAiB;IACvD,8CAA8C;IAC9C,cAAc,CAAC,EAAE,sBAAsB,CAAA;IACvC,oCAAoC;IACpC,YAAY,CAAC,EAAE;QACd,mCAAmC;QACnC,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,+CAA+C;QAC/C,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,KAAK,MAAM,CAAA;KAC7B,CAAA;CACD;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC/B,mDAAmD;IACnD,OAAO,EAAE,OAAO,CAAA;IAChB,gCAAgC;IAChC,OAAO,EAAE,GAAG,CAAA;IACZ,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAA;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAClC,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,oCAAoC;IACpC,KAAK,EAAE,MAAM,EAAE,CAAA;CACf;AAGD,MAAM,WAAW,WAAW;IAC3B,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,UAAU,CAAC,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;CAClB"}

package/src/index.ts

@@ -1,15 +0,0 @@
-export { createAbility, detectSubjectType } from './middleware/ability'
-export type { AppAbility, AbilityBuilderFunction } from './middleware/ability'
-export { createCaslMiddleware } from './middleware/graphql'
-export { pglCaslPlugin } from './middleware/postgraphile'
-export type {
-	User,
-	Context,
-	MiddlewareOptions,
-	FieldPermission,
-	ResolverFn,
-	MiddlewareFn,
-	PluginOptions,
-	AbilityResponse,
-	CreateAbilityInput,
-} from './types'

package/src/middleware/ability.ts

@@ -1,197 +0,0 @@
-import {
-	AbilityBuilder,
-	PureAbility,
-	type AbilityClass,
-	type FieldMatcher,
-	type ConditionsMatcher,
-} from '@casl/ability'
-
-import type { Context } from '../types'
-
-/**
- * Detects the subject type from an object for CASL authorization
- * @param object - The object to detect the subject type from
- * @returns The subject type string
- * @public
- */
-export const detectSubjectType = (object: any): string => {
-	// Handle CASL's subject() helper objects
-	if (object && typeof object === 'object') {
-		// CASL uses __caslSubjectType__ property
-		if ('__caslSubjectType__' in object) {
-			return object.__caslSubjectType__
-		}
-		// Fallback to other type indicators
-		if (object.type) return object.type
-		if (object.constructor?.name && object.constructor.name !== 'Object') {
-			return object.constructor.name
-		}
-	}
-	return 'Unknown'
-}
-
-// Simple field matcher - checks if a field is in the restricted list
-const fieldMatcher: FieldMatcher = fields => field => {
-	if (!fields || !field) return false
-	if (Array.isArray(fields)) {
-		return fields.includes(field)
-	}
-	return fields === field
-}
-
-// Simple conditions matcher - basic equality check
-const conditionsMatcher: ConditionsMatcher<any> = conditions => object => {
-	if (!conditions || !object) return true
-
-	return Object.keys(conditions).every(key => {
-		const conditionValue = conditions[key]
-		const objectValue = object[key]
-
-		// Simple equality check
-		return objectValue === conditionValue
-	})
-}
-
-/**
- * CASL ability type for authorization with flexible subject types
- * @public
- */
-export type AppAbility = PureAbility<[string, any], any>
-
-/**
- * Function type for building user abilities
- * @public
- */
-export type AbilityBuilderFunction = (user?: Context['user']) => Promise<AppAbility> | AppAbility
-
-const Ability = PureAbility as AbilityClass<AppAbility>
-
-/**
- * Default ability builder - only provides minimal public access
- */
-export const defaultAbilityBuilder = (_user?: Context['user']): AppAbility => {
-	const { can, build } = new AbilityBuilder<AppAbility>(Ability)
-
-	can('read', 'Query')
-
-	return build({
-		detectSubjectType,
-		fieldMatcher,
-		conditionsMatcher,
-	})
-}
-
-/**
- * Create ability using a provided builder function
- * @param user - User information for building the ability
- * @param builderFn - Function to build the ability
- * @returns Promise resolving to the created ability
- * @public
- */
-export const createAbility = async (
-	user?: Context['user'],
-	builderFn: AbilityBuilderFunction = defaultAbilityBuilder
-): Promise<AppAbility> => {
-	return await builderFn(user)
-}
-
-/**
- * Factory function for creating custom ability builders
- */
-export const createDatabaseAbilityBuilder = (
-	fetchRules: (userId?: string) => Promise<any[]>
-): AbilityBuilderFunction => {
-	return async (user?: Context['user']) => {
-		const { can, cannot, build } = new AbilityBuilder<AppAbility>(Ability)
-
-		if (user?.id) {
-			const rules = await fetchRules(user.id)
-
-			rules.forEach(rule => {
-				if (rule.inverted) {
-					cannot(rule.action, rule.subject, rule.fields, rule.conditions)
-				} else {
-					can(rule.action, rule.subject, rule.fields, rule.conditions)
-				}
-			})
-		} else {
-			can('read', 'Query')
-		}
-
-		return build({
-			detectSubjectType,
-			fieldMatcher,
-			conditionsMatcher,
-		})
-	}
-}
-
-/**
- * Create an ability builder from static configuration
- */
-export const createConfigBasedAbilityBuilder = (config: {
-	roles: Record<
-		string,
-		Array<{
-			action: string | string[]
-			subject: string
-			fields?: string | string[]
-			conditions?: any
-			inverted?: boolean
-		}>
-	>
-	defaultRules?: Array<{
-		action: string | string[]
-		subject: string
-		fields?: string | string[]
-		conditions?: any
-	}>
-}): AbilityBuilderFunction => {
-	return (user?: Context['user']) => {
-		const { can, cannot, build } = new AbilityBuilder<AppAbility>(Ability)
-
-		// Apply default rules
-		if (config.defaultRules) {
-			config.defaultRules.forEach(rule => {
-				can(rule.action, rule.subject, rule.fields, rule.conditions)
-			})
-		}
-
-		// Apply role-based rules
-		if (user?.roles) {
-			user.roles.forEach(role => {
-				const rules = config.roles[role]
-				if (rules) {
-					rules.forEach(rule => {
-						// Process template variables in conditions
-						let processedConditions = rule.conditions
-						if (processedConditions && user.id) {
-							const condStr = JSON.stringify(processedConditions)
-							if (condStr.includes('{{userId}}')) {
-								processedConditions = JSON.parse(condStr.replace(/{{userId}}/g, user.id))
-							}
-						}
-
-						if (rule.inverted) {
-							cannot(rule.action, rule.subject, rule.fields, processedConditions)
-						} else {
-							can(rule.action, rule.subject, rule.fields, processedConditions)
-						}
-					})
-				}
-			})
-		}
-
-		return build({
-			detectSubjectType,
-			fieldMatcher,
-			conditionsMatcher,
-		})
-	}
-}
-
-export const createAbilityFactory = <T extends PureAbility>(
-	builderFn: (user?: Context['user']) => T
-): ((user?: Context['user']) => T) => {
-	return (user?: Context['user']) => builderFn(user)
-}

package/src/middleware/graphql.ts

@@ -1,157 +0,0 @@
-import { subject } from '@casl/ability'
-import { GraphQLError, GraphQLResolveInfo } from 'graphql'
-import { parse, visit, FieldNode, DocumentNode } from 'graphql/language'
-import { Context, MiddlewareOptions, ResolverFn } from '../types'
-import { createAbility, defaultAbilityBuilder } from './ability'
-
-// Helper to extract operation name from GraphQL info
-const getOperationName = (info: GraphQLResolveInfo): string => {
-	return info.operation.operation.toLowerCase()
-}
-
-// Helper to get full field path
-const getFieldPath = (info: GraphQLResolveInfo): string => {
-	return info.path.typename ? `${info.path.typename}.${info.path.key}` : String(info.path.key)
-}
-
-// Parse GraphQL query to extract accessed fields
-const extractAccessedFields = (query: string): string[] => {
-	const fields: string[] = []
-
-	try {
-		const ast: DocumentNode = parse(query)
-
-		visit(ast, {
-			Field: {
-				enter(node: FieldNode) {
-					if (node.name.value !== '__typename') {
-						fields.push(node.name.value)
-					}
-				},
-			},
-		})
-	} catch (error) {
-		console.error('Failed to parse GraphQL query:', error)
-	}
-
-	return fields
-}
-
-// Check if ability allows the operation
-const checkPermission = (context: Context, action: string, subjectName: string, conditions?: any): boolean => {
-	if (!context.ability) {
-		return false
-	}
-
-	try {
-		// Only use subject helper if we have specific conditions to check
-		// (not just resolver args, but actual CASL conditions)
-		if (conditions && typeof conditions === 'object') {
-			return context.ability.can(action, subject(subjectName, conditions))
-		} else {
-			// Simple check without conditions - just action and subject type
-			return context.ability.can(action, subjectName)
-		}
-	} catch (error) {
-		console.error('Permission check failed:', error)
-		return false
-	}
-}
-
-/**
- * Creates CASL authorization middleware for GraphQL resolvers
- * @param options - Configuration options for the middleware
- * @returns Middleware function that wraps resolvers with authorization checks
- * @public
- */
-export const createCaslMiddleware = (options: MiddlewareOptions = {}) => {
-	const {
-		subjectMap = {},
-		actionMap = {
-			query: 'read',
-			mutation: 'update',
-			subscription: 'read',
-		},
-		fieldPermissions = {},
-		abilityBuilder = defaultAbilityBuilder,
-		debug = false,
-	} = options
-
-	return async (
-		resolve: ResolverFn,
-		root: any,
-		args: any,
-		context: Context,
-		info: GraphQLResolveInfo
-	): Promise<any> => {
-		// Create ability if not already in context
-		if (!context.ability) {
-			context.ability = await createAbility(context.user, abilityBuilder)
-		}
-
-		const operation = getOperationName(info)
-		const fieldPath = getFieldPath(info)
-		const action = actionMap[operation] || operation
-
-		// Get subject from map or default to type name
-		const subjectType = info.parentType.name
-		const subjectName = subjectMap[subjectType] || subjectType
-
-		if (debug) {
-			console.debug(`Checking permission: ${action} on ${subjectName} at ${fieldPath}`)
-		}
-
-		// Check field-level permissions if defined
-		if (fieldPermissions[fieldPath]) {
-			const permissions = fieldPermissions[fieldPath]
-			const allowed = permissions.some(permission =>
-				// Don't pass resolver args here - only use them if the permission defines conditions
-				checkPermission(context, permission.action, permission.subject, permission.conditions)
-			)
-
-			if (!allowed) {
-				throw new GraphQLError(`Access denied for field ${fieldPath}`)
-			}
-		}
-
-		// Check operation-level permission
-		// Don't pass resolver args as conditions - they're not CASL conditions
-		const allowed = checkPermission(context, action, subjectName)
-
-		if (!allowed) {
-			throw new GraphQLError(`Access denied for ${action} on ${subjectName}`)
-		}
-
-		// Additional checks for mutations with input fields
-		if (operation === 'mutation' && args.input) {
-			const querySource = info.operation.loc?.source.body
-
-			if (querySource) {
-				const accessedFields = extractAccessedFields(querySource)
-
-				for (const field of accessedFields) {
-					// Check field-level update permissions if needed
-					const fieldAllowed = checkPermission(context, 'update', subjectName, { field })
-
-					if (!fieldAllowed && debug) {
-						console.warn(`Warning: Field ${field} update not explicitly allowed`)
-					}
-				}
-			}
-		}
-
-		// Call the resolver
-		return resolve(root, args, context, info)
-	}
-}
-
-// Utility function to combine multiple middlewares
-export const combineMiddlewares = (...middlewares: any[]) => {
-	return (resolve: ResolverFn, root: any, args: any, context: any, info: any) => {
-		const chain = middlewares.reduceRight(
-			(next, middleware) => () => middleware(next, root, args, context, info),
-			() => resolve(root, args, context, info)
-		)
-		return chain()
-	}
-}