@terreno/feature-flags 0.12.0 → 0.12.1

package/dist/featureFlagsApp.js

@@ -77,9 +77,9 @@ var FeatureFlagsApp = /** @class */ (function () {
     }
     FeatureFlagsApp.prototype.register = function (app, openApi) {
         var _this = this;
-        var _a;
+        var _a, _b;
         var basePath = (_a = this.options.basePath) !== null && _a !== void 0 ? _a : "/feature-flags";
-        var routerOptions = __assign(__assign({}, (openApi ? { openApi: openApi } : {})), { permissions: {
+        var routerOptions = __assign(__assign({}, (openApi ? { openApi: openApi } : {})), { permissions: (_b = this.options.permissions) !== null && _b !== void 0 ? _b : {
                 create: [api_1.Permissions.IsAdmin],
                 delete: [api_1.Permissions.IsAdmin],
                 list: [api_1.Permissions.IsAdmin],
@@ -109,10 +109,13 @@ var FeatureFlagsApp = /** @class */ (function () {
         }); }));
         // GET /feature-flags/segments — list registered segment names (admin only)
         app.get("".concat(basePath, "/segments"), (0, api_1.authenticateMiddleware)(), (0, api_1.asyncHandler)(function (req, res) { return __awaiter(_this, void 0, void 0, function () {
-            var user;
+            var user, allowed;
             return __generator(this, function (_a) {
                 user = req.user;
-                if (!(user === null || user === void 0 ? void 0 : user.admin)) {
+                allowed = this.options.segmentsPermission
+                    ? this.options.segmentsPermission(user)
+                    : Boolean(user === null || user === void 0 ? void 0 : user.admin);
+                if (!allowed) {
                     throw new api_1.APIError({ status: 403, title: "Only admins can view segments" });
                 }
                 return [2 /*return*/, res.json({ data: Object.keys(this.segments) })];

package/dist/types.d.ts

@@ -1,4 +1,4 @@
-import type { FindExactlyOnePlugin, FindOneOrNonePlugin } from "@terreno/api";
+import type { FindExactlyOnePlugin, FindOneOrNonePlugin, ModelRouterOptions } from "@terreno/api";
 import type mongoose from "mongoose";
 export interface FeatureFlagVariant {
     key: string;
@@ -32,5 +32,18 @@ export type SegmentFunction = (user: unknown) => boolean;
 export interface FeatureFlagsOptions {
     basePath?: string;
     segments?: Record<string, SegmentFunction>;
+    /**
+     * Permission predicates that gate the admin CRUD routes for flags. When
+     * omitted, defaults to requiring `Permissions.IsAdmin` (i.e. `user.admin === true`)
+     * on every method. Provide this when consumers need role-based gating
+     * other than the boolean `admin` flag.
+     */
+    permissions?: ModelRouterOptions<FeatureFlagDocument>["permissions"];
+    /**
+     * Predicate used to gate the `/segments` admin endpoint. Receives the
+     * authenticated user and should return true to allow the request. Defaults
+     * to checking `user.admin === true` when not provided.
+     */
+    segmentsPermission?: (user: unknown) => boolean;
 }
 export type EvaluationResult = Record<string, boolean | string | null>;

package/package.json

@@ -4,7 +4,7 @@
     "url": "https://github.com/FlourishHealth/terreno/issues"
   },
   "dependencies": {
-    "@terreno/api": "0.12.0",
+    "@terreno/api": "0.12.1",
     "express": "^5.2.1",
     "lodash": "^4.17.23"
   },
@@ -51,5 +51,5 @@
     "test:coverage": "bun run ../scripts/check-coverage.ts"
   },
   "types": "dist/index.d.ts",
-  "version": "0.12.0"
+  "version": "0.12.1"
 }

package/src/featureFlagsApp.ts

@@ -45,7 +45,7 @@ export class FeatureFlagsApp implements TerrenoPlugin {
     const basePath = this.options.basePath ?? "/feature-flags";
     const routerOptions: ModelRouterOptions<FeatureFlagDocument> = {
       ...(openApi ? {openApi: openApi as OpenApiMiddleware} : {}),
-      permissions: {
+      permissions: this.options.permissions ?? {
         create: [Permissions.IsAdmin],
         delete: [Permissions.IsAdmin],
         list: [Permissions.IsAdmin],
@@ -83,8 +83,11 @@ export class FeatureFlagsApp implements TerrenoPlugin {
       `${basePath}/segments`,
       authenticateMiddleware(),
       asyncHandler(async (req: express.Request, res: express.Response) => {
-        const user = req.user as {admin?: boolean} | undefined;
-        if (!user?.admin) {
+        const user = req.user;
+        const allowed = this.options.segmentsPermission
+          ? this.options.segmentsPermission(user)
+          : Boolean((user as {admin?: boolean} | undefined)?.admin);
+        if (!allowed) {
           throw new APIError({status: 403, title: "Only admins can view segments"});
         }
 

package/src/types.ts

@@ -1,4 +1,4 @@
-import type {FindExactlyOnePlugin, FindOneOrNonePlugin} from "@terreno/api";
+import type {FindExactlyOnePlugin, FindOneOrNonePlugin, ModelRouterOptions} from "@terreno/api";
 import type mongoose from "mongoose";
 
 export interface FeatureFlagVariant {
@@ -41,6 +41,19 @@ export type SegmentFunction = (user: unknown) => boolean;
 export interface FeatureFlagsOptions {
   basePath?: string;
   segments?: Record<string, SegmentFunction>;
+  /**
+   * Permission predicates that gate the admin CRUD routes for flags. When
+   * omitted, defaults to requiring `Permissions.IsAdmin` (i.e. `user.admin === true`)
+   * on every method. Provide this when consumers need role-based gating
+   * other than the boolean `admin` flag.
+   */
+  permissions?: ModelRouterOptions<FeatureFlagDocument>["permissions"];
+  /**
+   * Predicate used to gate the `/segments` admin endpoint. Receives the
+   * authenticated user and should return true to allow the request. Defaults
+   * to checking `user.admin === true` when not provided.
+   */
+  segmentsPermission?: (user: unknown) => boolean;
 }
 
 export type EvaluationResult = Record<string, boolean | string | null>;