@team-codeme/crud-forge 0.0.0-stage → 1.0.1

package/src/templates/angular/auth/access-control.service.ts.ejs

@@ -0,0 +1,179 @@
+import { Injectable, computed, effect, inject, signal } from '@angular/core';
+import { catchError, forkJoin, map, of, switchMap, timeout } from 'rxjs';
+import { environment } from '@/environments/environment';
+import { AuthService } from './auth.service';
+import { KeycloakAdminService } from './keycloak-admin.service';
+import {
+  UserAttributes,
+  getScreenBaseId,
+  isComponentPermissionGranted,
+  isScreenPermissionGranted,
+  mergePermissionAttributes,
+  normalizeUserAttributes,
+  PROTECTED_USER_ATTRIBUTE_KEYS,
+  ROLE_METADATA_ATTRIBUTE_KEYS,
+} from '../utils/permission-attribute.util';
+import { ScreenNavigationRegistry } from '@/app/core/user-management/shared/screen-navigation.registry';
+
+@Injectable({ providedIn: 'root' })
+export class AccessControlService {
+  private readonly authService = inject(AuthService);
+  private readonly keycloakAdmin = inject(KeycloakAdminService);
+  private readonly screenNavigation = inject(ScreenNavigationRegistry);
+
+  readonly isLoaded = signal(false);
+  private readonly userAttributes = signal<UserAttributes | null>(null);
+
+  readonly userRoles = computed<string[]>(() => {
+    const user = this.authService.currentUser();
+    if (!user) {
+      return [];
+    }
+    const realmRoles = user.realm_access?.roles || [];
+    const clientRoles = user.resource_access?.[environment.kcClientId]?.roles || [];
+    return Array.from(new Set([...realmRoles, ...clientRoles])).map((role) => String(role).toUpperCase());
+  });
+
+  readonly isUserAdmin = computed(() => {
+    const adminRoles = (environment.adminRoles || []).map((role) => String(role).toUpperCase());
+    return this.userRoles().some((role) => adminRoles.includes(role));
+  });
+
+  private readonly resolvedAttributes = computed<UserAttributes>(() => {
+    return normalizeUserAttributes(this.userAttributes() || this.authService.currentUser()?.attributes || {});
+  });
+
+  constructor() {
+    effect((onCleanup) => {
+      const user = this.authService.currentUser();
+      if (!user) {
+        this.userAttributes.set(null);
+        this.isLoaded.set(false);
+        return;
+      }
+
+      this.isLoaded.set(false);
+      this.userAttributes.set(null);
+
+      const subscription = this.resolveSessionAttributes(user).subscribe({
+        next: (attributes) => {
+          this.userAttributes.set(attributes);
+          this.isLoaded.set(true);
+        },
+        error: () => {
+          this.isLoaded.set(true);
+        },
+      });
+      onCleanup(() => subscription.unsubscribe());
+    });
+  }
+
+  hasScreenAccess(screenId: string): boolean {
+    if (this.isUserAdmin()) {
+      return true;
+    }
+    if (isScreenPermissionGranted(this.resolvedAttributes(), screenId)) {
+      return true;
+    }
+    const segment = String(screenId || '').split('/').pop() || '';
+    if (segment && segment !== screenId && isScreenPermissionGranted(this.resolvedAttributes(), segment)) {
+      return true;
+    }
+    // Embedded child unlocks when a parent host page is granted (screen presence only).
+    return this.screenNavigation
+      .getParentHostScreenIds(screenId)
+      .some((parent) => isScreenPermissionGranted(this.resolvedAttributes(), parent));
+  }
+
+  hasComponentAccess(screenId: string, componentId: string): boolean {
+    if (this.isUserAdmin()) {
+      return true;
+    }
+    // PMB + CRUDForge stamps historically used different ids for the same controls.
+    const aliases: Record<string, string[]> = {
+      new: ['new', 'create'],
+      create: ['new', 'create'],
+      filter: ['filter', 'open-filter'],
+      'open-filter': ['filter', 'open-filter'],
+      'view-mode': ['view-mode', 'toggle-view'],
+      'toggle-view': ['view-mode', 'toggle-view'],
+      columns: ['columns', 'open-columns'],
+      'open-columns': ['columns', 'open-columns'],
+    };
+    const component = String(componentId || '').trim().toLowerCase();
+    const ids = aliases[component] || [component];
+    const attrs = this.resolvedAttributes();
+    const sId = screenId || '';
+    if (ids.some((id) => isComponentPermissionGranted(attrs, id, sId))) {
+      return true;
+    }
+    // Additive host/embed: accept grants stored on related screens — never invent action grants.
+    for (const child of this.screenNavigation.getEmbeddedChildScreenIds(sId)) {
+      if (ids.some((id) => isComponentPermissionGranted(attrs, id, child))) {
+        return true;
+      }
+    }
+    for (const parent of this.screenNavigation.getParentHostScreenIds(sId)) {
+      if (ids.some((id) => isComponentPermissionGranted(attrs, id, parent))) {
+        return true;
+      }
+    }
+    // Do NOT fall back to bare screen access — that would bypass explicit action grants.
+    return false;
+  }
+
+  private resolveSessionAttributes(user: { sub?: string }) {
+    const userId = typeof user?.sub === 'string' ? user.sub : null;
+    const fromUser$ = userId
+      ? this.keycloakAdmin.getUserById(userId).pipe(
+          timeout(3000),
+          map((kcUser) => normalizeUserAttributes(kcUser?.attributes || {})),
+          catchError(() => of({} as UserAttributes))
+        )
+      : of({} as UserAttributes);
+
+    return fromUser$.pipe(
+      switchMap((directAttrs) => {
+        if (Object.keys(directAttrs).length > 0) {
+          return of(directAttrs);
+        }
+        return this.resolveFromAssignedRoles();
+      })
+    );
+  }
+
+  private resolveFromAssignedRoles() {
+    const roles = this.userRoles();
+    if (!roles.length) {
+      return of({} as UserAttributes);
+    }
+
+    return forkJoin(
+      roles.map((role) =>
+        this.keycloakAdmin.getRealmRolePermissionAttributes(role).pipe(
+          catchError(() => of({} as UserAttributes))
+        )
+      )
+    ).pipe(
+      map((groups) => {
+        let merged: UserAttributes = {};
+        groups.forEach((group) => {
+          merged = mergePermissionAttributes(merged, group);
+        });
+        Object.keys(merged).forEach((key) => {
+          if (
+            PROTECTED_USER_ATTRIBUTE_KEYS.has(key.toLowerCase()) ||
+            ROLE_METADATA_ATTRIBUTE_KEYS.has(key.toLowerCase())
+          ) {
+            return;
+          }
+          const base = getScreenBaseId(key);
+          if (base && base !== key) {
+            merged[base] = Array.from(new Set([...(merged[base] || []), ...(merged[key] || [])]));
+          }
+        });
+        return merged;
+      })
+    );
+  }
+}

package/src/templates/angular/auth/access-ctrl.pipe.ts.ejs

@@ -0,0 +1,20 @@
+import { Pipe, PipeTransform, inject } from '@angular/core';
+import { AccessControlService } from '../services/access-control.service';
+
+@Pipe({
+  name: 'accessCtrl',
+  standalone: true,
+  pure: false,
+})
+export class AccessCtrlPipe implements PipeTransform {
+  private readonly accessControl = inject(AccessControlService);
+
+  transform(screenId: string, componentId?: string): boolean {
+    if (!this.accessControl.isLoaded() && !this.accessControl.isUserAdmin()) {
+      return false;
+    }
+    return componentId
+      ? this.accessControl.hasComponentAccess(screenId, componentId)
+      : this.accessControl.hasScreenAccess(screenId);
+  }
+}

package/src/templates/angular/auth/auth.guard.ts.ejs

@@ -0,0 +1,27 @@
+import { isPlatformBrowser } from '@angular/common';
+import { inject, PLATFORM_ID } from '@angular/core';
+import { CanActivateChildFn, CanActivateFn, Router } from '@angular/router';
+import { map, of } from 'rxjs';
+import { AuthService } from '../services/auth.service';
+
+export const AuthGuard: CanActivateFn | CanActivateChildFn = (_route, state) => {
+  const platformId = inject(PLATFORM_ID);
+  if (!isPlatformBrowser(platformId)) {
+    return of(true);
+  }
+
+  const router = inject(Router);
+  const authService = inject(AuthService);
+
+  return authService.check().pipe(
+    map((authenticated) => {
+      if (authenticated) {
+        return true;
+      }
+      const redirect = state.url && state.url !== '/auth/sign-out'
+        ? `?redirectURL=${encodeURIComponent(state.url)}`
+        : '';
+      return router.parseUrl(`/auth/sign-in${redirect}`);
+    })
+  );
+};

package/src/templates/angular/auth/auth.interceptor.ts.ejs

@@ -0,0 +1,53 @@
+import { HttpErrorResponse, HttpHandlerFn, HttpRequest } from '@angular/common/http';
+import { inject } from '@angular/core';
+import { environment } from '@/environments/environment';
+import { catchError, switchMap, throwError } from 'rxjs';
+import { AuthService } from '../services/auth.service';
+import { AuthUtils } from '../utils/auth.utils';
+
+export const authInterceptor = (req: HttpRequest<unknown>, next: HttpHandlerFn) => {
+  const authService = inject(AuthService);
+  const isTokenEndpoint = req.url.includes(environment.sso);
+
+  if (authService.isAuthenticated && !isTokenEndpoint) {
+    authService.resetInactivityTimer();
+  }
+
+  const withSessionHeaders = () => {
+    let headers = req.headers.delete('Cookie').delete('X-Tenant-ID');
+    if (environment.kcForwardedProto) {
+      headers = headers.set('X-Forwarded-Proto', environment.kcForwardedProto);
+    }
+    if (!isTokenEndpoint && authService.accessToken) {
+      headers = headers.set('Authorization', `Bearer ${authService.accessToken}`);
+    }
+    return req.clone({ headers });
+  };
+
+  const refreshAndRetry = () => authService.refreshAccessToken().pipe(
+    // Handle only token endpoint errors here, not errors from the retried API request.
+    catchError((error) => {
+      if (!authService.tryStartDisabledAccountLockFromAuthError(error) && authService.isTerminalAuthError(error)) {
+        authService.signOut('unauthorized');
+      }
+      return throwError(() => error);
+    }),
+    switchMap(() => next(withSessionHeaders()))
+  );
+
+  if (!isTokenEndpoint && !environment.useMockAuth && authService.refreshToken &&
+      AuthUtils.shouldRefreshAccessToken(authService.accessToken)) {
+    return refreshAndRetry();
+  }
+
+  return next(withSessionHeaders()).pipe(
+    catchError((error) => {
+      if (error instanceof HttpErrorResponse && error.status === 401 &&
+          !isTokenEndpoint && !environment.useMockAuth && authService.refreshToken) {
+        return refreshAndRetry();
+      }
+      // API 401/403 and transient failures do not revoke a valid PMB session.
+      return throwError(() => error);
+    })
+  );
+};