@things-factory/auth-base 6.2.103 → 6.2.114

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "6.2.103",
+  "version": "6.2.114",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -30,10 +30,10 @@
     "migration:create": "node ../../node_modules/typeorm/cli.js migration:create -d ./server/migrations"
   },
   "dependencies": {
-    "@things-factory/email-base": "^6.2.103",
+    "@things-factory/email-base": "^6.2.114",
     "@things-factory/env": "^6.2.103",
-    "@things-factory/i18n-base": "^6.2.103",
-    "@things-factory/shell": "^6.2.103",
+    "@things-factory/i18n-base": "^6.2.114",
+    "@things-factory/shell": "^6.2.114",
     "@things-factory/utils": "^6.2.103",
     "jsonwebtoken": "^9.0.0",
     "koa-passport": "^6.0.0",
@@ -43,5 +43,5 @@
     "passport-local": "^1.0.0",
     "popsicle-cookie-jar": "^1.0.0"
   },
-  "gitHead": "941f06e7c042ed4da546f96cc770e803b3ee1d71"
+  "gitHead": "6b471894613abd775ce70b23790f89a2505c825a"
 }

package/server/router/auth-private-process-router.ts

@@ -75,8 +75,8 @@ authPrivateProcessRouter
     var privileges = await User.getPrivilegesByDomain(user, domain)
 
     if (prohibitedPrivileges) {
-      prohibitedPrivileges.forEach(({ category, name }) => {
-        privileges = privileges.filter(p => p.category != category || p.name != name)
+      prohibitedPrivileges.forEach(({ category, privilege }) => {
+        privileges = privileges.filter(p => p.category != category || p.privilege != privilege)
       })
     }
 

package/server/service/privilege/privilege-query.ts

@@ -28,31 +28,14 @@ export class PrivilegeQuery {
     return { items, total }
   }
 
-  @Query(returns => [Privilege], {
-    description: 'To fetch current users privileges for current domain'
-  })
-  async myPrivileges(@Ctx() context: ResolverContext): Promise<Privilege[]> {
-    const { user, domain } = context.state
-
-    return User.getPrivilegesByDomain(user, domain)
-  }
-
   @Query(returns => Boolean, { description: 'To query whether I have the given permission' })
-  async hasPrivilege(
-    @Arg('privilege') privilege: string,
-    @Arg('category') category: string,
-    @Ctx() context: ResolverContext
-  ): Promise<Boolean> {
+  async hasPrivilege(@Arg('privilege') privilege: string, @Arg('category') category: string, @Ctx() context: ResolverContext): Promise<Boolean> {
     const { domain, user } = context.state
     return await User.hasPrivilege(privilege, category, domain, user)
   }
 
   @Query(returns => [Domain], { description: 'To fetch domains with given privilege for user' })
-  async domainsWithPrivilege(
-    @Arg('privilege') privilege: string,
-    @Arg('category') category: string,
-    @Ctx() context: ResolverContext
-  ): Promise<Partial<Domain>[]> {
+  async domainsWithPrivilege(@Arg('privilege') privilege: string, @Arg('category') category: string, @Ctx() context: ResolverContext): Promise<Partial<Domain>[]> {
     const { user } = context.state
     return await User.getDomainsWithPrivilege(privilege, category, user)
   }

package/server/service/user/user.ts

@@ -2,19 +2,7 @@ import crypto from 'crypto'
 import jwt from 'jsonwebtoken'
 import { Directive, Field, ID, ObjectType } from 'type-graphql'
 import { GraphQLEmailAddress } from 'graphql-scalars'
-import {
-  Column,
-  CreateDateColumn,
-  Entity,
-  Index,
-  JoinTable,
-  ManyToMany,
-  ManyToOne,
-  OneToMany,
-  PrimaryGeneratedColumn,
-  RelationId,
-  UpdateDateColumn
-} from 'typeorm'
+import { Column, CreateDateColumn, Entity, Index, JoinTable, ManyToMany, ManyToOne, OneToMany, PrimaryGeneratedColumn, RelationId, UpdateDateColumn } from 'typeorm'
 
 import { config } from '@things-factory/env'
 import { Domain, getRepository } from '@things-factory/shell'
@@ -23,6 +11,7 @@ import { validatePasswordByRule } from '../../controllers/utils/password-rule'
 import { AuthError } from '../../errors/auth-error'
 import { SECRET } from '../../utils/get-secret'
 import { Role } from '../role/role'
+import { Privilege } from '../privilege/privilege'
 import { UsersAuthProviders } from '../users-auth-providers/users-auth-providers'
 import { getDomainsWithPrivilege } from '../../utils/get-user-domains'
 
@@ -71,12 +60,7 @@ export class User {
   @Directive('@privilege(category: "security", privilege: "query", domainOwnerGranted: true)')
   @Column({
     nullable: true,
-    type:
-      DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'
-        ? 'longtext'
-        : DATABASE_TYPE == 'oracle'
-        ? 'clob'
-        : 'varchar'
+    type: DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? 'longtext' : DATABASE_TYPE == 'oracle' ? 'clob' : 'varchar'
   })
   password: string
 
@@ -113,12 +97,7 @@ export class User {
   ssoId: string
 
   @Column({
-    type:
-      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'
-        ? 'enum'
-        : DATABASE_TYPE == 'oracle'
-        ? 'varchar2'
-        : 'smallint',
+    type: DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? 'enum' : DATABASE_TYPE == 'oracle' ? 'varchar2' : 'smallint',
     enum: UserStatus,
     default: UserStatus.INACTIVE
   })
@@ -313,39 +292,41 @@ export class User {
     }
   }
 
-  static async hasPrivilege(privilege: string, category: string, domain: Domain, user: User) {
-    const result = await getRepository(User).query(
-      `
-      SELECT COUNT(1) AS "has_privilege" FROM "privileges" "PRIVILEGES"
-      WHERE "PRIVILEGES"."category" = '${category}'
-      AND "PRIVILEGES"."name" = '${privilege}'
-      AND "PRIVILEGES"."id" IN (
-        SELECT "RP"."privileges_id"
-        FROM "users_roles" "UR"
-        INNER JOIN "roles_privileges" "RP" ON "UR"."roles_id" = "RP"."roles_id"
-        LEFT JOIN "roles" "R" ON "R"."id" = "UR"."roles_id"
-        WHERE "UR"."users_id" = '${user?.id}'
-        AND "R"."domain_id" = '${domain?.id}'
-      )
-      `
-    )
-
-    return result[0].has_privilege > 0
+  static async hasPrivilege(privilege: string, category: string, domain: Domain, user: User): Promise<boolean> {
+    const result = await getRepository(Privilege)
+      .createQueryBuilder('privilege')
+      .innerJoin('privilege.roles', 'role')
+      .innerJoin('role.users', 'user')
+      .where('privilege.category = :category', { category })
+      .andWhere('privilege.name = :privilege', { privilege })
+      .andWhere('user.id = :userId', { userId: user.id })
+      .andWhere('role.domain.id = :domainId', { domainId: domain.id })
+      .getCount()
+
+    return result > 0
   }
 
-  static async getPrivilegesByDomain(user: User, domain: Domain) {
-    const result = await getRepository(User).query(`
-      SELECT name privilege, category FROM "privileges" "PRIVILEGES"
-      WHERE "PRIVILEGES"."id" IN (
-        SELECT "RP"."privileges_id"
-        FROM "users_roles" "UR"
-        INNER JOIN "roles_privileges" "RP" ON "UR"."roles_id" = "RP"."roles_id"
-        LEFT JOIN "roles" "R" ON "R"."id" = "UR"."roles_id"
-        WHERE "UR"."users_id" = '${user.id}'
-        AND "R"."domain_id" = '${domain.id}'
-      )`)
-
-    return result
+  static async getPrivilegesByDomain(user: User, domain: Domain): Promise<{ category: string; privilege: string }[]> {
+    const result = await getRepository(User)
+      .createQueryBuilder('user')
+      .leftJoinAndSelect('user.roles', 'role')
+      .leftJoinAndSelect('role.privileges', 'privilege')
+      .select(['privilege.name AS privilege', 'privilege.category AS category'])
+      .where('user.id = :userId', { userId: user.id })
+      .andWhere('role.domain.id = :domainId', { domainId: domain.id })
+      .orderBy('privilege.category')
+      .addOrderBy('privilege.name')
+      .getRawMany()
+
+    const distinct = result.reduce((acc, current) => {
+      const last = acc[acc.length - 1]
+      if (!last || last.privilege !== current.privilege || last.category !== current.category) {
+        acc.push(current)
+      }
+      return acc
+    }, [])
+
+    return distinct
   }
 
   static async getDomainsWithPrivilege(privilege: string, category: string, user: User) {