@things-factory/auth-base 10.1.142 → 10.1.146
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/config/config.development.js +4 -0
- package/config/config.production.js +4 -0
- package/dist-server/index.js +2 -9
- package/dist-server/index.js.map +1 -1
- package/dist-server/service/access-request/index.d.ts +1 -1
- package/dist-server/service/app-binding/index.d.ts +1 -1
- package/dist-server/service/appliance/index.d.ts +1 -1
- package/dist-server/service/application/index.d.ts +1 -1
- package/dist-server/service/domain-link/index.d.ts +1 -1
- package/dist-server/service/domain-owner/index.d.ts +1 -1
- package/dist-server/service/granted-role/index.d.ts +1 -1
- package/dist-server/service/index.d.ts +1 -1
- package/dist-server/service/invitation/index.d.ts +1 -1
- package/dist-server/service/partner/index.d.ts +1 -1
- package/dist-server/service/privilege/index.d.ts +1 -1
- package/dist-server/service/privilege/privilege-sync.d.ts +10 -0
- package/dist-server/service/privilege/privilege-sync.js +28 -0
- package/dist-server/service/privilege/privilege-sync.js.map +1 -0
- package/dist-server/service/role/index.d.ts +1 -1
- package/dist-server/service/role-template/index.d.ts +1 -1
- package/dist-server/service/user/index.d.ts +1 -1
- package/dist-server/service/verification-token/index.d.ts +1 -1
- package/dist-server/tsconfig.tsbuildinfo +1 -1
- package/package.json +4 -4
- package/tests/privilege-rejection.test.ts +2 -2
- package/tests/privilege-sync-db.test.ts +58 -0
- package/translations/es.json +254 -0
package/dist-server/index.js
CHANGED
|
@@ -1,8 +1,7 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
const tslib_1 = require("tslib");
|
|
4
|
-
const
|
|
5
|
-
const privilege_js_1 = require("./service/privilege/privilege.js");
|
|
4
|
+
const privilege_sync_js_1 = require("./service/privilege/privilege-sync.js");
|
|
6
5
|
const privilege_axis_js_1 = require("./service/privilege/privilege-axis.js");
|
|
7
6
|
const role_template_js_1 = require("./service/role-template/role-template.js");
|
|
8
7
|
require("./routes.js");
|
|
@@ -29,13 +28,7 @@ tslib_1.__exportStar(require("./utils/build-auth-url.js"), exports);
|
|
|
29
28
|
tslib_1.__exportStar(require("./errors/index.js"), exports);
|
|
30
29
|
tslib_1.__exportStar(require("./types.js"), exports);
|
|
31
30
|
process.on('bootstrap-module-start', async ({ app, config, client }) => {
|
|
32
|
-
|
|
33
|
-
const privilegeRepository = (0, shell_1.getRepository)(privilege_js_1.Privilege);
|
|
34
|
-
for (const [category, name] of Object.values(privileges)) {
|
|
35
|
-
if (0 == (await privilegeRepository.count({ where: { category, name } }))) {
|
|
36
|
-
await privilegeRepository.save({ category, name });
|
|
37
|
-
}
|
|
38
|
-
}
|
|
31
|
+
await (0, privilege_sync_js_1.synchronizePrivileges)(Object.values(process['PRIVILEGES']));
|
|
39
32
|
console.log('[auth-base:bootstrap] Synchronization for privilege master has just done.');
|
|
40
33
|
/*
|
|
41
34
|
* Templates name privileges by (category, axis), and a category can move. A template
|
package/dist-server/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../server/index.ts"],"names":[],"mappings":";;;AAAA,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../server/index.ts"],"names":[],"mappings":";;;AAAA,6EAA6E;AAC7E,6EAA0E;AAC1E,+EAAsF;AAEtF,uBAAoB;AAEpB,6DAAkC;AAClC,uGAAuG;AACvG,6EAAkD;AAClD,yEAA8C;AAE9C,gEAAqC;AAErC,iEAAsC;AACtC,4DAAiC;AACjC,sDAA2B;AAE3B,sEAA2C;AAC3C,sEAA2C;AAC3C,yEAA8C;AAC9C,6EAAkD;AAClD,sEAA2C;AAC3C,gEAAqC;AACrC,+EAAoD;AACpD,yEAA8C;AAC9C,mEAAwC;AACxC,sEAA2C;AAC3C,yEAA8C;AAC9C,oEAAyC;AAEzC,4DAAiC;AAEjC,qDAA0B;AAE1B,OAAO,CAAC,EAAE,CAAC,wBAA+B,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAO,EAAE,EAAE;IACjF,MAAM,IAAA,yCAAqB,EAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAqC,CAAC,CAAC,CAAA;IAErG,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAA;IAExF;;;;;OAKG;IACH,IAAA,8CAA2B,GAAE,CAAA;IAE7B;;;;;OAKG;IACH,IAAA,sCAAkB,GAAE,CAAA;AACtB,CAAC,CAAC,CAAA","sourcesContent":["import { synchronizePrivileges } from './service/privilege/privilege-sync.js'\nimport { reportDeclaredAxes } from './service/privilege/privilege-axis.js'\nimport { reportUnknownTemplateGrants } from './service/role-template/role-template.js'\n\nimport './routes.js'\n\nexport * from './service/index.js'\n/* AI 입력 declarations - plain data, registered by an application that runs the assistant (ADR-0103). */\nexport * from './ai-entry/access-entry-targets.js'\nexport * from './ai-entry/access-assistant.js'\nexport type { EntryTargetDeclaration as AuthEntryTarget } from './ai-entry/entry-target-shape.js'\nexport * from './migrations/index.js'\n\nexport * from './middlewares/index.js'\nexport * from './router/index.js'\nexport * from './routes.js'\n\nexport * from './utils/get-domain-users.js'\nexport * from './utils/get-user-domains.js'\nexport * from './utils/checkin-domain-rule.js'\nexport * from './utils/can-user-checkin-domain.js'\nexport * from './utils/domain-ownership.js'\nexport * from './utils/get-secret.js'\nexport * from './utils/check-user-belongs-domain.js'\nexport * from './utils/access-token-cookie.js'\nexport * from './utils/encrypt-state.js'\nexport * from './utils/check-permission.js'\nexport * from './utils/check-user-has-role.js'\nexport * from './utils/build-auth-url.js'\n\nexport * from './errors/index.js'\n\nexport * from './types.js'\n\nprocess.on('bootstrap-module-start' as any, async ({ app, config, client }: any) => {\n await synchronizePrivileges(Object.values(process['PRIVILEGES'] as Record<string, [string, string]>))\n\n console.log('[auth-base:bootstrap] Synchronization for privilege master has just done.')\n\n /*\n * Templates name privileges by (category, axis), and a category can move. A template\n * that survives a rename becomes a role that grants nothing — the administrator picks\n * \"quality inspector\", gets a role, and no door opens. Check the names once, here, where\n * the privilege registry has just been filled.\n */\n reportUnknownTemplateGrants()\n\n /*\n * Say which axis vocabulary this installation ended up with. It cannot go in the SDL —\n * it differs per installation, which is the whole point — so a boot line is the honest\n * substitute, and it separates \"nobody declared, these are the defaults\" from \"someone\n * declared exactly these\".\n */\n reportDeclaredAxes()\n})\n"]}
|
|
@@ -2,4 +2,4 @@ import { AccessRequest } from './access-request.js';
|
|
|
2
2
|
import { AccessRequestMutation } from './access-request-mutation.js';
|
|
3
3
|
import { AccessRequestQuery } from './access-request-query.js';
|
|
4
4
|
export declare const entities: (typeof AccessRequest)[];
|
|
5
|
-
export declare const resolvers: (typeof
|
|
5
|
+
export declare const resolvers: (typeof AccessRequestMutation | typeof AccessRequestQuery)[];
|
|
@@ -1,3 +1,3 @@
|
|
|
1
1
|
import { AppBindingQuery } from './app-binding-query.js';
|
|
2
2
|
import { AppBindingMutation } from './app-binding-mutation.js';
|
|
3
|
-
export declare const resolvers: (typeof
|
|
3
|
+
export declare const resolvers: (typeof AppBindingQuery | typeof AppBindingMutation)[];
|
|
@@ -2,4 +2,4 @@ import { Appliance } from './appliance.js';
|
|
|
2
2
|
import { ApplianceQuery } from './appliance-query.js';
|
|
3
3
|
import { ApplianceMutation } from './appliance-mutation.js';
|
|
4
4
|
export declare const entities: (typeof Appliance)[];
|
|
5
|
-
export declare const resolvers: (typeof
|
|
5
|
+
export declare const resolvers: (typeof ApplianceQuery | typeof ApplianceMutation)[];
|
|
@@ -2,4 +2,4 @@ import { Application } from './application.js';
|
|
|
2
2
|
import { ApplicationQuery } from './application-query.js';
|
|
3
3
|
import { ApplicationMutation } from './application-mutation.js';
|
|
4
4
|
export declare const entities: (typeof Application)[];
|
|
5
|
-
export declare const resolvers: (typeof
|
|
5
|
+
export declare const resolvers: (typeof ApplicationQuery | typeof ApplicationMutation)[];
|
|
@@ -2,5 +2,5 @@ import { DomainLink } from './domain-link.js';
|
|
|
2
2
|
import { DomainLinkQuery } from './domain-link-query.js';
|
|
3
3
|
import { DomainLinkMutation } from './domain-link-mutation.js';
|
|
4
4
|
export declare const entities: (typeof DomainLink)[];
|
|
5
|
-
export declare const resolvers: (typeof
|
|
5
|
+
export declare const resolvers: (typeof DomainLinkQuery | typeof DomainLinkMutation)[];
|
|
6
6
|
export declare const subscribers: any[];
|
|
@@ -2,4 +2,4 @@ import { DomainOwner } from './domain-owner.js';
|
|
|
2
2
|
import { DomainOwnerQuery } from './domain-owner-query.js';
|
|
3
3
|
import { DomainOwnerMutation } from './domain-owner-mutation.js';
|
|
4
4
|
export declare const entities: (typeof DomainOwner)[];
|
|
5
|
-
export declare const resolvers: (typeof
|
|
5
|
+
export declare const resolvers: (typeof DomainOwnerQuery | typeof DomainOwnerMutation)[];
|
|
@@ -2,4 +2,4 @@ import { GrantedRole } from './granted-role.js';
|
|
|
2
2
|
import { GrantedRoleQuery } from './granted-role-query.js';
|
|
3
3
|
import { GrantedRoleMutation } from './granted-role-mutation.js';
|
|
4
4
|
export declare const entities: (typeof GrantedRole)[];
|
|
5
|
-
export declare const resolvers: (typeof
|
|
5
|
+
export declare const resolvers: (typeof GrantedRoleQuery | typeof GrantedRoleMutation)[];
|
|
@@ -33,7 +33,7 @@ export * from './role/role-types.js';
|
|
|
33
33
|
export * from './user/user-types.js';
|
|
34
34
|
export * from './domain-link/domain-link-types.js';
|
|
35
35
|
export * from './access-request/access-request-types.js';
|
|
36
|
-
export declare const entities: (typeof import("./
|
|
36
|
+
export declare const entities: (typeof import("./web-auth-credential/web-auth-credential.js").WebAuthCredential | typeof import("./user/user.js").User | typeof import("./auth-provider/auth-provider.js").AuthProvider | typeof import("./users-auth-providers/users-auth-providers.js").UsersAuthProviders | typeof import("./domain-owner/domain-owner.js").DomainOwner | typeof import("./granted-role/granted-role.js").GrantedRole | typeof import("./role/role.js").Role | typeof import("./privilege/privilege.js").Privilege | typeof import("./password-history/password-history.js").PasswordHistory | typeof import("./verification-token/verification-token.js").VerificationToken | typeof import("./verification-token/verification-token.js").VerificationTokenType | typeof import("./invitation/invitation.js").Invitation | typeof import("./application/application.js").Application | typeof import("./login-history/login-history.js").LoginHistory | typeof import("./access-request/access-request.js").AccessRequest | typeof import("./appliance/appliance.js").Appliance | typeof import("./partner/partner.js").Partner | typeof import("./domain-link/domain-link.js").DomainLink)[];
|
|
37
37
|
export declare const schema: {
|
|
38
38
|
typeDefs: {
|
|
39
39
|
privilegeDirectiveTypeDefs: import("graphql").DocumentNode;
|
|
@@ -2,4 +2,4 @@ import { Invitation } from './invitation.js';
|
|
|
2
2
|
import { InvitationQuery } from './invitation-query.js';
|
|
3
3
|
import { InvitationMutation } from './invitation-mutation.js';
|
|
4
4
|
export declare const entities: (typeof Invitation)[];
|
|
5
|
-
export declare const resolvers: (typeof
|
|
5
|
+
export declare const resolvers: (typeof InvitationQuery | typeof InvitationMutation)[];
|
|
@@ -2,4 +2,4 @@ import { Partner } from './partner.js';
|
|
|
2
2
|
import { PartnerQuery } from './partner-query.js';
|
|
3
3
|
import { PartnerMutation } from './partner-mutation.js';
|
|
4
4
|
export declare const entities: (typeof Partner)[];
|
|
5
|
-
export declare const resolvers: (typeof
|
|
5
|
+
export declare const resolvers: (typeof PartnerQuery | typeof PartnerMutation)[];
|
|
@@ -2,4 +2,4 @@ import { Privilege } from './privilege.js';
|
|
|
2
2
|
import { PrivilegeQuery } from './privilege-query.js';
|
|
3
3
|
import { PrivilegeMutation } from './privilege-mutation.js';
|
|
4
4
|
export declare const entities: (typeof Privilege)[];
|
|
5
|
-
export declare const resolvers: (typeof
|
|
5
|
+
export declare const resolvers: (typeof PrivilegeQuery | typeof PrivilegeMutation)[];
|
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Writes the privileges the loaded modules declare and the table does not have yet. Returns the ones it
|
|
3
|
+
* added.
|
|
4
|
+
*
|
|
5
|
+
* It takes its turn among the boot-time writers (shell `inBootTurn`). On sqlite every transaction shares
|
|
6
|
+
* one connection: run beside another module's boot transaction, its insert started in the same tick as
|
|
7
|
+
* that one ("cannot start a transaction within a transaction") or rode inside it and went when it rolled
|
|
8
|
+
* back. The privilege was then missing again at the next boot, and the collision repeated every boot.
|
|
9
|
+
*/
|
|
10
|
+
export declare function synchronizePrivileges(declared: Iterable<[string, string]>): Promise<string[]>;
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.synchronizePrivileges = synchronizePrivileges;
|
|
4
|
+
const shell_1 = require("@things-factory/shell");
|
|
5
|
+
const privilege_js_1 = require("./privilege.js");
|
|
6
|
+
/**
|
|
7
|
+
* Writes the privileges the loaded modules declare and the table does not have yet. Returns the ones it
|
|
8
|
+
* added.
|
|
9
|
+
*
|
|
10
|
+
* It takes its turn among the boot-time writers (shell `inBootTurn`). On sqlite every transaction shares
|
|
11
|
+
* one connection: run beside another module's boot transaction, its insert started in the same tick as
|
|
12
|
+
* that one ("cannot start a transaction within a transaction") or rode inside it and went when it rolled
|
|
13
|
+
* back. The privilege was then missing again at the next boot, and the collision repeated every boot.
|
|
14
|
+
*/
|
|
15
|
+
async function synchronizePrivileges(declared) {
|
|
16
|
+
return await (0, shell_1.inBootTurn)(async () => {
|
|
17
|
+
const repository = (0, shell_1.getRepository)(privilege_js_1.Privilege);
|
|
18
|
+
const added = [];
|
|
19
|
+
for (const [category, name] of declared) {
|
|
20
|
+
if (0 == (await repository.count({ where: { category, name } }))) {
|
|
21
|
+
await repository.save({ category, name });
|
|
22
|
+
added.push(`${category}/${name}`);
|
|
23
|
+
}
|
|
24
|
+
}
|
|
25
|
+
return added;
|
|
26
|
+
});
|
|
27
|
+
}
|
|
28
|
+
//# sourceMappingURL=privilege-sync.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"privilege-sync.js","sourceRoot":"","sources":["../../../server/service/privilege/privilege-sync.ts"],"names":[],"mappings":";;AAaA,sDAcC;AA3BD,iDAAiE;AAEjE,iDAA0C;AAE1C;;;;;;;;GAQG;AACI,KAAK,UAAU,qBAAqB,CAAC,QAAoC;IAC9E,OAAO,MAAM,IAAA,kBAAU,EAAC,KAAK,IAAI,EAAE;QACjC,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,wBAAS,CAAC,CAAA;QAC3C,MAAM,KAAK,GAAa,EAAE,CAAA;QAE1B,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;gBACjE,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;gBACzC,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAA;YACnC,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { getRepository, inBootTurn } from '@things-factory/shell'\n\nimport { Privilege } from './privilege.js'\n\n/**\n * Writes the privileges the loaded modules declare and the table does not have yet. Returns the ones it\n * added.\n *\n * It takes its turn among the boot-time writers (shell `inBootTurn`). On sqlite every transaction shares\n * one connection: run beside another module's boot transaction, its insert started in the same tick as\n * that one (\"cannot start a transaction within a transaction\") or rode inside it and went when it rolled\n * back. The privilege was then missing again at the next boot, and the collision repeated every boot.\n */\nexport async function synchronizePrivileges(declared: Iterable<[string, string]>): Promise<string[]> {\n return await inBootTurn(async () => {\n const repository = getRepository(Privilege)\n const added: string[] = []\n\n for (const [category, name] of declared) {\n if (0 == (await repository.count({ where: { category, name } }))) {\n await repository.save({ category, name })\n added.push(`${category}/${name}`)\n }\n }\n\n return added\n })\n}\n"]}
|
|
@@ -3,4 +3,4 @@ import { RoleQuery } from './role-query.js';
|
|
|
3
3
|
import { RoleMutation } from './role-mutation.js';
|
|
4
4
|
import { RolePrivilegeQuery } from './role-privilege-query.js';
|
|
5
5
|
export declare const entities: (typeof Role)[];
|
|
6
|
-
export declare const resolvers: (typeof
|
|
6
|
+
export declare const resolvers: (typeof RoleQuery | typeof RoleMutation | typeof RolePrivilegeQuery)[];
|
|
@@ -2,4 +2,4 @@ import { RoleTemplateGapResolver } from './role-template-gap-resolver.js';
|
|
|
2
2
|
import { RoleTemplateMutation } from './role-template-mutation.js';
|
|
3
3
|
import { RoleTemplateQuery } from './role-template-query.js';
|
|
4
4
|
export declare const entities: any[];
|
|
5
|
-
export declare const resolvers: (typeof
|
|
5
|
+
export declare const resolvers: (typeof RoleTemplateGapResolver | typeof RoleTemplateMutation | typeof RoleTemplateQuery)[];
|
|
@@ -3,4 +3,4 @@ import { UserQuery } from './user-query.js';
|
|
|
3
3
|
import { UserMutation } from './user-mutation.js';
|
|
4
4
|
import { DomainQuery } from './domain-query.js';
|
|
5
5
|
export declare const entities: (typeof User)[];
|
|
6
|
-
export declare const resolvers: (typeof
|
|
6
|
+
export declare const resolvers: (typeof UserQuery | typeof UserMutation | typeof DomainQuery)[];
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
import { VerificationToken, VerificationTokenType } from './verification-token.js';
|
|
2
|
-
export declare const entities: (typeof
|
|
2
|
+
export declare const entities: (typeof VerificationToken | typeof VerificationTokenType)[];
|