@things-factory/shell 10.1.227 → 10.1.234

package/dist-server/middlewares/domain-middleware.js

@@ -5,6 +5,7 @@ exports.domainMiddleware = domainMiddleware;
 const tslib_1 = require("tslib");
 const request_ip_1 = tslib_1.__importDefault(require("request-ip"));
 const get_domain_js_1 = require("../utils/get-domain.js");
+const ip_list_rule_js_1 = require("./ip-list-rule.js");
 /**
  * The reason an address was refused, as a header the client can read.
  *
@@ -36,27 +37,19 @@ async function domainMiddleware(context, next) {
         const { whitelist = [], blacklist = [], protectedlist = [], privileges = [] } = domain.iplist || {};
         if (Array.isArray(whitelist) && whitelist.length > 0) {
             /* whitelist 우선 */
-            const whitelisted = Array.isArray(whitelist) &&
-                whitelist.some(item => {
-                    return new RegExp(item).test(ip);
-                });
+            const whitelisted = (0, ip_list_rule_js_1.ipListMatches)(whitelist, ip);
             if (!whitelisted) {
                 return refuseByAddress(context);
             }
         }
         else {
-            const blacklisted = Array.isArray(blacklist) &&
-                blacklist.some(item => {
-                    return new RegExp(item).test(ip);
-                });
+            const blacklisted = Array.isArray(blacklist) && (0, ip_list_rule_js_1.ipListMatches)(blacklist, ip);
             if (blacklisted) {
                 return refuseByAddress(context);
             }
         }
         if (Array.isArray(protectedlist) && protectedlist.length > 0) {
-            const safe = protectedlist.some(item => {
-                return new RegExp(item).test(ip);
-            });
+            const safe = (0, ip_list_rule_js_1.ipListMatches)(protectedlist, ip);
             context.state.unsafeIP = !safe;
             if (!safe) {
                 /* `by` tells the refusal it was the address - a role would not open it (ADR-0103 decision 1). */

package/dist-server/middlewares/domain-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"domain-middleware.js","sourceRoot":"","sources":["../../server/middlewares/domain-middleware.ts"],"names":[],"mappings":";;;AAqBA,4CAuDC;;AA5ED,oEAAkC;AAClC,0DAAyD;AAEzD;;;;;;;;;GASG;AACU,QAAA,cAAc,GAAG,WAAW,CAAA;AAC5B,QAAA,eAAe,GAAG,qBAAqB,CAAA;AAEpD,SAAS,eAAe,CAAC,OAAY;IACnC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;IACpB,OAAO,CAAC,GAAG,CAAC,sBAAc,EAAE,uBAAe,CAAC,CAAA;AAC9C,CAAC;AAEM,KAAK,UAAU,gBAAgB,CAAC,OAAY,EAAE,IAAS;IAC5D,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ;;;;WAIG;QACH,MAAM,GAAG,MAAM,IAAA,gCAAgB,EAAC,OAAO,CAAC,CAAA;IAC1C,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,oBAAS,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC7C,MAAM,EAAE,SAAS,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,EAAE,aAAa,GAAG,EAAE,EAAE,UAAU,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAA;QAEnG,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,kBAAkB;YAClB,MAAM,WAAW,GACf,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;gBACxB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBACpB,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBAClC,CAAC,CAAC,CAAA;YAEJ,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,eAAe,CAAC,OAAO,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GACf,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;gBACxB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBACpB,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBAClC,CAAC,CAAC,CAAA;YAEJ,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,eAAe,CAAC,OAAO,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACrC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAClC,CAAC,CAAC,CAAA;YAEF,OAAO,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAA;YAE9B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,iGAAiG;gBACjG,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;YAC9H,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAA;IAE7B,OAAO,IAAI,EAAE,CAAA;AACf,CAAC","sourcesContent":["import requestIp from 'request-ip'\nimport { getDomainFromURL } from '../utils/get-domain.js'\n\n/**\n * The reason an address was refused, as a header the client can read.\n *\n * The domain's IP lists answer 403, and so does \"no domain chosen\" (domain-authenticate-middleware).\n * The client sent both to check-in; for a refused address check-in sends the person straight back,\n * so the screen stopped with nothing said (ADR README, plan 3). With this header the client can tell\n * the two apart and say what happened - the address is not let in, and check-in cannot change that.\n *\n * A header, not a body: it reaches the client whatever the request was (GraphQL, HTML, a file).\n */\nexport const REFUSAL_HEADER = 'x-refusal'\nexport const REFUSED_ADDRESS = 'address-not-allowed'\n\nfunction refuseByAddress(context: any) {\n  context.status = 403\n  context.set(REFUSAL_HEADER, REFUSED_ADDRESS)\n}\n\nexport async function domainMiddleware(context: any, next: any) {\n  var { domain } = context.state\n  if (!domain) {\n    /*\n     * The domainTypes should be checked only when signin and checkin.\n     * For purposes such as API calls, the target domainTypes may be different from the system domainTypes.\n     * So, we don't check domainTypes here.\n     */\n    domain = await getDomainFromURL(context)\n  }\n\n  if (domain) {\n    const ip = requestIp.getClientIp(context.req)\n    const { whitelist = [], blacklist = [], protectedlist = [], privileges = [] } = domain.iplist || {}\n\n    if (Array.isArray(whitelist) && whitelist.length > 0) {\n      /* whitelist 우선 */\n      const whitelisted =\n        Array.isArray(whitelist) &&\n        whitelist.some(item => {\n          return new RegExp(item).test(ip)\n        })\n\n      if (!whitelisted) {\n        return refuseByAddress(context)\n      }\n    } else {\n      const blacklisted =\n        Array.isArray(blacklist) &&\n        blacklist.some(item => {\n          return new RegExp(item).test(ip)\n        })\n\n      if (blacklisted) {\n        return refuseByAddress(context)\n      }\n    }\n\n    if (Array.isArray(protectedlist) && protectedlist.length > 0) {\n      const safe = protectedlist.some(item => {\n        return new RegExp(item).test(ip)\n      })\n\n      context.state.unsafeIP = !safe\n\n      if (!safe) {\n        /* `by` tells the refusal it was the address - a role would not open it (ADR-0103 decision 1). */\n        context.state.prohibitedPrivileges = (Array.isArray(privileges) ? privileges : []).map(item => ({ ...item, by: 'address' }))\n      }\n    }\n  }\n\n  context.state.domain = domain\n\n  return next()\n}\n"]}
+{"version":3,"file":"domain-middleware.js","sourceRoot":"","sources":["../../server/middlewares/domain-middleware.ts"],"names":[],"mappings":";;;AAsBA,4CA6CC;;AAnED,oEAAkC;AAClC,0DAAyD;AACzD,uDAAiD;AAEjD;;;;;;;;;GASG;AACU,QAAA,cAAc,GAAG,WAAW,CAAA;AAC5B,QAAA,eAAe,GAAG,qBAAqB,CAAA;AAEpD,SAAS,eAAe,CAAC,OAAY;IACnC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;IACpB,OAAO,CAAC,GAAG,CAAC,sBAAc,EAAE,uBAAe,CAAC,CAAA;AAC9C,CAAC;AAEM,KAAK,UAAU,gBAAgB,CAAC,OAAY,EAAE,IAAS;IAC5D,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ;;;;WAIG;QACH,MAAM,GAAG,MAAM,IAAA,gCAAgB,EAAC,OAAO,CAAC,CAAA;IAC1C,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,oBAAS,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC7C,MAAM,EAAE,SAAS,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,EAAE,aAAa,GAAG,EAAE,EAAE,UAAU,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAA;QAEnG,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,kBAAkB;YAClB,MAAM,WAAW,GAAG,IAAA,+BAAa,EAAC,SAAS,EAAE,EAAE,CAAC,CAAA;YAEhD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,eAAe,CAAC,OAAO,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAA,+BAAa,EAAC,SAAS,EAAE,EAAE,CAAC,CAAA;YAE5E,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,eAAe,CAAC,OAAO,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,IAAA,+BAAa,EAAC,aAAa,EAAE,EAAE,CAAC,CAAA;YAE7C,OAAO,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAA;YAE9B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,iGAAiG;gBACjG,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;YAC9H,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAA;IAE7B,OAAO,IAAI,EAAE,CAAA;AACf,CAAC","sourcesContent":["import requestIp from 'request-ip'\nimport { getDomainFromURL } from '../utils/get-domain.js'\nimport { ipListMatches } from './ip-list-rule.js'\n\n/**\n * The reason an address was refused, as a header the client can read.\n *\n * The domain's IP lists answer 403, and so does \"no domain chosen\" (domain-authenticate-middleware).\n * The client sent both to check-in; for a refused address check-in sends the person straight back,\n * so the screen stopped with nothing said (ADR README, plan 3). With this header the client can tell\n * the two apart and say what happened - the address is not let in, and check-in cannot change that.\n *\n * A header, not a body: it reaches the client whatever the request was (GraphQL, HTML, a file).\n */\nexport const REFUSAL_HEADER = 'x-refusal'\nexport const REFUSED_ADDRESS = 'address-not-allowed'\n\nfunction refuseByAddress(context: any) {\n  context.status = 403\n  context.set(REFUSAL_HEADER, REFUSED_ADDRESS)\n}\n\nexport async function domainMiddleware(context: any, next: any) {\n  var { domain } = context.state\n  if (!domain) {\n    /*\n     * The domainTypes should be checked only when signin and checkin.\n     * For purposes such as API calls, the target domainTypes may be different from the system domainTypes.\n     * So, we don't check domainTypes here.\n     */\n    domain = await getDomainFromURL(context)\n  }\n\n  if (domain) {\n    const ip = requestIp.getClientIp(context.req)\n    const { whitelist = [], blacklist = [], protectedlist = [], privileges = [] } = domain.iplist || {}\n\n    if (Array.isArray(whitelist) && whitelist.length > 0) {\n      /* whitelist 우선 */\n      const whitelisted = ipListMatches(whitelist, ip)\n\n      if (!whitelisted) {\n        return refuseByAddress(context)\n      }\n    } else {\n      const blacklisted = Array.isArray(blacklist) && ipListMatches(blacklist, ip)\n\n      if (blacklisted) {\n        return refuseByAddress(context)\n      }\n    }\n\n    if (Array.isArray(protectedlist) && protectedlist.length > 0) {\n      const safe = ipListMatches(protectedlist, ip)\n\n      context.state.unsafeIP = !safe\n\n      if (!safe) {\n        /* `by` tells the refusal it was the address - a role would not open it (ADR-0103 decision 1). */\n        context.state.prohibitedPrivileges = (Array.isArray(privileges) ? privileges : []).map(item => ({ ...item, by: 'address' }))\n      }\n    }\n  }\n\n  context.state.domain = domain\n\n  return next()\n}\n"]}

package/dist-server/middlewares/ip-list-rule.d.ts

@@ -0,0 +1,10 @@
+/**
+ * A domain's IP lists hold regular expressions, matched against the client address as they are written
+ * (`^10\.` for a prefix). One entry that is not a regular expression used to throw on every request of the
+ * domain, so the lists are checked when they are saved, and a bad entry already stored is passed over.
+ */
+export declare const IP_LISTS: readonly ["whitelist", "blacklist", "protectedlist"];
+/** True when an entry of the list matches the address. A stored entry that does not compile matches nothing. */
+export declare function ipListMatches(entries: unknown[], ip: string): boolean;
+/** Refuses the first entry, of whichever list, that is blank or not a regular expression - naming the list and the entry. */
+export declare function refuseBadIPList(iplist: Record<string, unknown> | null | undefined): void;

package/dist-server/middlewares/ip-list-rule.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IP_LISTS = void 0;
+exports.ipListMatches = ipListMatches;
+exports.refuseBadIPList = refuseBadIPList;
+const env_1 = require("@things-factory/env");
+const refusal_js_1 = require("../refusal/refusal.js");
+/**
+ * A domain's IP lists hold regular expressions, matched against the client address as they are written
+ * (`^10\.` for a prefix). One entry that is not a regular expression used to throw on every request of the
+ * domain, so the lists are checked when they are saved, and a bad entry already stored is passed over.
+ */
+exports.IP_LISTS = ['whitelist', 'blacklist', 'protectedlist'];
+const compiled = new Map();
+function patternOf(entry) {
+    if (!compiled.has(entry)) {
+        try {
+            compiled.set(entry, new RegExp(entry));
+        }
+        catch (e) {
+            env_1.logger.warn(`ip list entry "${entry}" is not a regular expression and matches nothing`);
+            compiled.set(entry, null);
+        }
+    }
+    return compiled.get(entry);
+}
+/** True when an entry of the list matches the address. A stored entry that does not compile matches nothing. */
+function ipListMatches(entries, ip) {
+    return entries.some(entry => typeof entry === 'string' && !!patternOf(entry)?.test(ip));
+}
+/** Refuses the first entry, of whichever list, that is blank or not a regular expression - naming the list and the entry. */
+function refuseBadIPList(iplist) {
+    for (const list of exports.IP_LISTS) {
+        const entries = iplist?.[list];
+        if (entries == null)
+            continue;
+        if (!Array.isArray(entries)) {
+            throw new refusal_js_1.Refusal(`ip-${list}-entry-invalid`, { entry: String(entries) }, `"${entries}" in the ${list} is not a regular expression`);
+        }
+        for (const entry of entries) {
+            if (typeof entry === 'string' && !entry.trim()) {
+                throw new refusal_js_1.Refusal(`ip-${list}-entry-empty`, {}, `the ${list} has an empty entry`);
+            }
+            try {
+                if (typeof entry !== 'string')
+                    throw new TypeError();
+                new RegExp(entry);
+            }
+            catch (e) {
+                throw new refusal_js_1.Refusal(`ip-${list}-entry-invalid`, { entry: String(entry) }, `"${entry}" in the ${list} is not a regular expression`);
+            }
+        }
+    }
+}
+//# sourceMappingURL=ip-list-rule.js.map

package/dist-server/middlewares/ip-list-rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-list-rule.js","sourceRoot":"","sources":["../../server/middlewares/ip-list-rule.ts"],"names":[],"mappings":";;;AA2BA,sCAEC;AAGD,0CAoBC;AApDD,6CAA4C;AAE5C,sDAA+C;AAE/C;;;;GAIG;AAEU,QAAA,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,eAAe,CAAU,CAAA;AAE5E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAA;AAEjD,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;QACxC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,YAAM,CAAC,IAAI,CAAC,kBAAkB,KAAK,mDAAmD,CAAC,CAAA;YACvF,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AAC5B,CAAC;AAED,gHAAgH;AAChH,SAAgB,aAAa,CAAC,OAAkB,EAAE,EAAU;IAC1D,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;AACzF,CAAC;AAED,6HAA6H;AAC7H,SAAgB,eAAe,CAAC,MAAkD;IAChF,KAAK,MAAM,IAAI,IAAI,gBAAQ,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,OAAO,IAAI,IAAI;YAAE,SAAQ;QAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,oBAAO,CAAC,MAAM,IAAI,gBAAgB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,OAAO,YAAY,IAAI,8BAA8B,CAAC,CAAA;QACtI,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC/C,MAAM,IAAI,oBAAO,CAAC,MAAM,IAAI,cAAc,EAAE,EAAE,EAAE,OAAO,IAAI,qBAAqB,CAAC,CAAA;YACnF,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,MAAM,IAAI,SAAS,EAAE,CAAA;gBACpD,IAAI,MAAM,CAAC,KAAK,CAAC,CAAA;YACnB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,oBAAO,CAAC,MAAM,IAAI,gBAAgB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,KAAK,YAAY,IAAI,8BAA8B,CAAC,CAAA;YAClI,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { logger } from '@things-factory/env'\n\nimport { Refusal } from '../refusal/refusal.js'\n\n/**\n * A domain's IP lists hold regular expressions, matched against the client address as they are written\n * (`^10\\.` for a prefix). One entry that is not a regular expression used to throw on every request of the\n * domain, so the lists are checked when they are saved, and a bad entry already stored is passed over.\n */\n\nexport const IP_LISTS = ['whitelist', 'blacklist', 'protectedlist'] as const\n\nconst compiled = new Map<string, RegExp | null>()\n\nfunction patternOf(entry: string): RegExp | null {\n  if (!compiled.has(entry)) {\n    try {\n      compiled.set(entry, new RegExp(entry))\n    } catch (e) {\n      logger.warn(`ip list entry \"${entry}\" is not a regular expression and matches nothing`)\n      compiled.set(entry, null)\n    }\n  }\n  return compiled.get(entry)\n}\n\n/** True when an entry of the list matches the address. A stored entry that does not compile matches nothing. */\nexport function ipListMatches(entries: unknown[], ip: string): boolean {\n  return entries.some(entry => typeof entry === 'string' && !!patternOf(entry)?.test(ip))\n}\n\n/** Refuses the first entry, of whichever list, that is blank or not a regular expression - naming the list and the entry. */\nexport function refuseBadIPList(iplist: Record<string, unknown> | null | undefined): void {\n  for (const list of IP_LISTS) {\n    const entries = iplist?.[list]\n    if (entries == null) continue\n    if (!Array.isArray(entries)) {\n      throw new Refusal(`ip-${list}-entry-invalid`, { entry: String(entries) }, `\"${entries}\" in the ${list} is not a regular expression`)\n    }\n\n    for (const entry of entries) {\n      if (typeof entry === 'string' && !entry.trim()) {\n        throw new Refusal(`ip-${list}-entry-empty`, {}, `the ${list} has an empty entry`)\n      }\n      try {\n        if (typeof entry !== 'string') throw new TypeError()\n        new RegExp(entry)\n      } catch (e) {\n        throw new Refusal(`ip-${list}-entry-invalid`, { entry: String(entry) }, `\"${entry}\" in the ${list} is not a regular expression`)\n      }\n    }\n  }\n}\n"]}

package/dist-server/service/domain/domain-mutation.js

@@ -9,6 +9,8 @@ const database_js_1 = require("../../initializers/database.js");
 const domain_js_1 = require("./domain.js");
 const domain_types_js_1 = require("./domain-types.js");
 const scalar_object_js_1 = require("../common-types/scalar-object.js");
+const ip_list_rule_js_1 = require("../../middlewares/ip-list-rule.js");
+const refusal_js_1 = require("../../refusal/refusal.js");
 let DomainMutation = class DomainMutation {
     async createDomain(domainInput) {
         const { name, description } = domainInput;
@@ -82,7 +84,7 @@ let DomainMutation = class DomainMutation {
     async updateSecureIPList(iplist, context) {
         const { domain } = context.state;
         const repository = (0, database_js_1.getRepository)(domain_js_1.Domain);
-        // const domain: Domain = await repository.findOneBy({ id })
+        (0, ip_list_rule_js_1.refuseBadIPList)(iplist);
         const { iplist: result } = await repository.save({
             ...domain,
             iplist
@@ -151,6 +153,7 @@ tslib_1.__decorate([
     (0, type_graphql_1.Directive)('@transaction'),
     (0, type_graphql_1.Directive)('@privilege(category: "security", privilege: "mutation", domainOwnerGranted: true, superUserGranted: true)'),
     (0, type_graphql_1.Mutation)(returns => scalar_object_js_1.ScalarObject, { nullable: true, description: 'To update secure IP list for domain' }),
+    (0, type_graphql_1.UseMiddleware)(refusal_js_1.SpeakRefusals),
     tslib_1.__param(0, (0, type_graphql_1.Arg)('iplist', type => scalar_object_js_1.ScalarObject)),
     tslib_1.__param(1, (0, type_graphql_1.Ctx)()),
     tslib_1.__metadata("design:type", Function),

package/dist-server/service/domain/domain-mutation.js.map

@@ -1 +1 @@
-{"version":3,"file":"domain-mutation.js","sourceRoot":"","sources":["../../../server/service/domain/domain-mutation.ts"],"names":[],"mappings":";;;;AAAA,+CAAyF;AACzF,qCAAwC;AAExC,iDAA+C;AAE/C,gEAA8D;AAE9D,2CAA4C;AAC5C,uDAA+C;AAC/C,uEAA+D;AAGxD,IAAM,cAAc,GAApB,MAAM,cAAc;IAOnB,AAAN,KAAK,CAAC,YAAY,CAC4E,WAAwB;QAEpH,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,WAAW,CAAA;QACzC,MAAM,UAAU,GAAuB,IAAA,2BAAa,EAAC,kBAAM,CAAC,CAAA;QAC5D,MAAM,SAAS,GAAW,IAAA,eAAO,EAAC,IAAI,CAAC,CAAA;QAEvC,MAAM,MAAM,GAAW,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QAChE,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;QACzC,CAAC;QAED,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAA;IAChE,CAAC;IAQK,AAAN,KAAK,CAAC,YAAY,CAAoE,IAAY;QAChG,OAAO,MAAM,IAAA,2BAAa,EAAC,kBAAM,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,CAAC;IAQK,AAAN,KAAK,CAAC,aAAa,CACqE,KAAe;QAErG,MAAM,OAAO,GAAa,MAAM,IAAA,2BAAa,EAAC,kBAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAA,YAAE,EAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;QAC1F,MAAM,SAAS,GAAa,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAE5D,MAAM,IAAA,2BAAa,EAAC,kBAAM,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,SAAS,CAAC,EAAE,CAAC,CAAA;IAC3D,CAAC;IAOK,AAAN,KAAK,CAAC,YAAY,CAAc,IAAY,EAAmC,KAAkB;QAC/F,MAAM,UAAU,GAAG,IAAA,2BAAa,EAAC,kBAAM,CAAC,CAAA;QACxC,MAAM,MAAM,GAAW,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QAE3D,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC,MAAM,CAAA;QACrB,CAAC;QAED,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC;YAC3B,GAAG,MAAM;YACT,GAAG,KAAK;SACF,CAAC,CAAA;IACX,CAAC;IAOK,AAAN,KAAK,CAAC,aAAa,CAAsC,OAAsB;QAC7E,MAAM,UAAU,GAAuB,IAAA,2BAAa,EAAC,kBAAM,CAAC,CAAA;QAE5D,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAU,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAEzD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,8DAA8D;YAC9D,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAC,YAAY,EAAC,EAAE;gBAChC,MAAM,MAAM,GAAW,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;gBAEnF,wEAAwE;gBACxE,8DAA8D;gBAC9D,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;oBAC3B,YAAY,CAAC,SAAS,GAAG,IAAA,eAAO,EAAC,YAAY,CAAC,SAAS,CAAC,CAAA;oBACxD,IAAI,YAAY,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;wBAChD,oCAAoC;wBACpC,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;4BACvD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;wBAC/D,CAAC;wBACD,2CAA2C;wBAC3C,IAAI,YAAY,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;4BACxC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;wBAC3E,CAAC;wBACD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,CAAA;wBAC7E,IAAI,GAAG,IAAI,GAAG,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;4BAChC,MAAM,IAAI,KAAK,CAAC,cAAc,YAAY,CAAC,SAAS,sBAAsB,CAAC,CAAA;wBAC7E,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,OAAO,YAAY,CAAC,SAAS,CAAA;gBAC/B,CAAC;gBAED,IAAI,YAAY,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;oBAC/D,OAAO,YAAY,CAAC,MAAM,CAAA;gBAC5B,CAAC;gBAED,MAAM,UAAU,CAAC,IAAI,CAAC;oBACpB,GAAG,MAAM;oBACT,GAAG,YAAY;iBACT,CAAC,CAAA;YACX,CAAC,CAAC,CACH,CAAA;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAOK,AAAN,KAAK,CAAC,kBAAkB,CACe,MAAc,EAC5C,OAAY;QAEnB,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAChC,MAAM,UAAU,GAAG,IAAA,2BAAa,EAAC,kBAAM,CAAC,CAAA;QACxC,4DAA4D;QAE5D,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC;YAC/C,GAAG,MAAM;YACT,MAAM;SACA,CAAC,CAAA;QAET,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AA3IY,wCAAc;AAOnB;IANL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,wBAAS,EAAC,oCAAoC,CAAC;IAC/C,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,kBAAM,EAAE;QAC3B,WAAW,EACT,8IAA8I;KACjJ,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,aAAa,EAAE,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC,CAAA;;6CAAc,6BAAW;;kDAYrH;AAQK;IANL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,wBAAS,EAAC,oCAAoC,CAAC;IAC/C,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,kBAAM,EAAE;QAC3B,WAAW,EACT,oIAAoI;KACvI,CAAC;IACkB,mBAAA,IAAA,kBAAG,EAAC,MAAM,EAAE,EAAE,WAAW,EAAE,mCAAmC,EAAE,CAAC,CAAA;;;;kDAEpF;AAQK;IANL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,wBAAS,EAAC,oCAAoC,CAAC;IAC/C,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,mJAAmJ;KACtJ,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC,CAAA;;;;mDAMtF;AAOK;IALL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,wBAAS,EAAC,oCAAoC,CAAC;IAC/C,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,kBAAM,EAAE;QAC3B,WAAW,EAAE,8DAA8D;KAC5E,CAAC;IACkB,mBAAA,IAAA,kBAAG,EAAC,MAAM,CAAC,CAAA;IAAgB,mBAAA,IAAA,kBAAG,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,6BAAW,CAAC,CAAA;;qDAAQ,6BAAW;;kDAYhG;AAOK;IALL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,wBAAS,EAAC,oCAAoC,CAAC;IAC/C,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EAAE,wEAAwE;KACtF,CAAC;IACmB,mBAAA,IAAA,kBAAG,EAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,6BAAW,CAAC,CAAC,CAAA;;;;mDA8CvD;AAOK;IALL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,wBAAS,EACR,2GAA2G,CAC5G;IACA,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,+BAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;IAEvG,mBAAA,IAAA,kBAAG,EAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,+BAAY,CAAC,CAAA;IACnC,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;wDAYP;yBA1IU,cAAc;IAD1B,IAAA,uBAAQ,EAAC,kBAAM,CAAC;GACJ,cAAc,CA2I1B","sourcesContent":["import { Arg, Args, Ctx, Directive, Mutation, Query, Resolver, Root } from 'type-graphql'\nimport { In, Repository } from 'typeorm'\n\nimport { slugger } from '@things-factory/utils'\n\nimport { getRepository } from '../../initializers/database.js'\n\nimport { Domain, IPList } from './domain.js'\nimport { DomainPatch } from './domain-types.js'\nimport { ScalarObject } from '../common-types/scalar-object.js'\n\n@Resolver(Domain)\nexport class DomainMutation {\n  @Directive('@transaction')\n  @Directive('@privilege(superUserGranted: true)')\n  @Mutation(returns => Domain, {\n    description:\n      'Creates a new domain entity. Only superusers are granted this privilege. Use this mutation to register a new domain with a unique subdomain.'\n  })\n  async createDomain(\n    @Arg('domainInput', { description: 'The input object containing the new domain details.' }) domainInput: DomainPatch\n  ) {\n    const { name, description } = domainInput\n    const domainRepo: Repository<Domain> = getRepository(Domain)\n    const subdomain: string = slugger(name)\n\n    const domain: Domain = await domainRepo.findOneBy({ subdomain })\n    if (domain) {\n      throw new Error('domain is duplicated')\n    }\n\n    return await domainRepo.save({ name, description, subdomain })\n  }\n\n  @Directive('@transaction')\n  @Directive('@privilege(superUserGranted: true)')\n  @Mutation(returns => Domain, {\n    description:\n      'Deletes a domain entity by its name. Only superusers are granted this privilege. Use this mutation to permanently remove a domain.'\n  })\n  async deleteDomain(@Arg('name', { description: 'The name of the domain to delete.' }) name: string) {\n    return await getRepository(Domain).delete({ name })\n  }\n\n  @Directive('@transaction')\n  @Directive('@privilege(superUserGranted: true)')\n  @Mutation(returns => Boolean, {\n    description:\n      'Deletes multiple domain entities by their names. Only superusers are granted this privilege. Use this mutation to remove several domains at once.'\n  })\n  async deleteDomains(\n    @Arg('names', () => [String], { description: 'An array of domain names to delete.' }) names: string[]\n  ) {\n    const domains: Domain[] = await getRepository(Domain).find({ where: { name: In(names) } })\n    const domainIds: string[] = domains.map(domain => domain.id)\n\n    await getRepository(Domain).delete({ id: In(domainIds) })\n  }\n\n  @Directive('@transaction')\n  @Directive('@privilege(superUserGranted: true)')\n  @Mutation(returns => Domain, {\n    description: 'To update domain (Only superuser is granted this privilege.)'\n  })\n  async updateDomain(@Arg('name') name: string, @Arg('patch', () => DomainPatch) patch: DomainPatch) {\n    const repository = getRepository(Domain)\n    const domain: Domain = await repository.findOneBy({ name })\n\n    if (patch.parent && patch.parent.id == domain.id) {\n      delete patch.parent\n    }\n\n    return await repository.save({\n      ...domain,\n      ...patch\n    } as any)\n  }\n\n  @Directive('@transaction')\n  @Directive('@privilege(superUserGranted: true)')\n  @Mutation(returns => Boolean, {\n    description: 'To update multiple domains (Only superuser is granted this privilege.)'\n  })\n  async updateDomains(@Arg('patches', () => [DomainPatch]) patches: DomainPatch[]): Promise<boolean> {\n    const domainRepo: Repository<Domain> = getRepository(Domain)\n\n    const patchIds = patches.filter((patch: any) => patch.id)\n\n    if (patchIds.length > 0) {\n      /* 모든 저장을 await 해야 @transaction 스코프 안에서 커밋되고 에러가 호출자에 전파된다. */\n      await Promise.all(\n        patchIds.map(async updateRecord => {\n          const domain: Domain = await domainRepo.findOne({ where: { id: updateRecord.id } })\n\n          // 1. 도메인명(name)만 변경할 때는 slugger로 subdomain을 덮어쓰지 않는다 (기존 subdomain 유지).\n          // 2. subdomain이 명시적으로 패치에 포함된 경우에만 slugger를 적용하고 중복 검사를 수행한다.\n          if (updateRecord.subdomain) {\n            updateRecord.subdomain = slugger(updateRecord.subdomain)\n            if (updateRecord.subdomain !== domain.subdomain) {\n              // 'system' 도메인의 서브도메인은 절대 변경할 수 없다.\n              if (domain.subdomain === 'system' || domain.systemFlag) {\n                throw new Error(\"The 'system' subdomain cannot be modified.\")\n              }\n              // 'system' 서브도메인은 예약어이므로 다른 도메인이 차지할 수 없다.\n              if (updateRecord.subdomain === 'system') {\n                throw new Error(\"The subdomain 'system' is reserved and cannot be used.\")\n              }\n              const dup = await domainRepo.findOneBy({ subdomain: updateRecord.subdomain })\n              if (dup && dup.id !== domain.id) {\n                throw new Error(`Subdomain '${updateRecord.subdomain}' is already in use.`)\n              }\n            }\n          } else {\n            delete updateRecord.subdomain\n          }\n\n          if (updateRecord.parent && updateRecord.parent.id == domain.id) {\n            delete updateRecord.parent\n          }\n\n          await domainRepo.save({\n            ...domain,\n            ...updateRecord\n          } as any)\n        })\n      )\n    }\n\n    return true\n  }\n\n  @Directive('@transaction')\n  @Directive(\n    '@privilege(category: \"security\", privilege: \"mutation\", domainOwnerGranted: true, superUserGranted: true)'\n  )\n  @Mutation(returns => ScalarObject, { nullable: true, description: 'To update secure IP list for domain' })\n  async updateSecureIPList(\n    @Arg('iplist', type => ScalarObject) iplist: IPList,\n    @Ctx() context: any\n  ): Promise<IPList | null> {\n    const { domain } = context.state\n    const repository = getRepository(Domain)\n    // const domain: Domain = await repository.findOneBy({ id })\n\n    const { iplist: result } = await repository.save({\n      ...domain,\n      iplist\n    } as any)\n\n    return result\n  }\n}\n"]}
+{"version":3,"file":"domain-mutation.js","sourceRoot":"","sources":["../../../server/service/domain/domain-mutation.ts"],"names":[],"mappings":";;;;AAAA,+CAAwG;AACxG,qCAAwC;AAExC,iDAA+C;AAE/C,gEAA8D;AAE9D,2CAA4C;AAC5C,uDAA+C;AAC/C,uEAA+D;AAC/D,uEAAmE;AACnE,yDAAwD;AAGjD,IAAM,cAAc,GAApB,MAAM,cAAc;IAOnB,AAAN,KAAK,CAAC,YAAY,CAC4E,WAAwB;QAEpH,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,WAAW,CAAA;QACzC,MAAM,UAAU,GAAuB,IAAA,2BAAa,EAAC,kBAAM,CAAC,CAAA;QAC5D,MAAM,SAAS,GAAW,IAAA,eAAO,EAAC,IAAI,CAAC,CAAA;QAEvC,MAAM,MAAM,GAAW,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QAChE,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;QACzC,CAAC;QAED,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAA;IAChE,CAAC;IAQK,AAAN,KAAK,CAAC,YAAY,CAAoE,IAAY;QAChG,OAAO,MAAM,IAAA,2BAAa,EAAC,kBAAM,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,CAAC;IAQK,AAAN,KAAK,CAAC,aAAa,CACqE,KAAe;QAErG,MAAM,OAAO,GAAa,MAAM,IAAA,2BAAa,EAAC,kBAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAA,YAAE,EAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;QAC1F,MAAM,SAAS,GAAa,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAE5D,MAAM,IAAA,2BAAa,EAAC,kBAAM,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,SAAS,CAAC,EAAE,CAAC,CAAA;IAC3D,CAAC;IAOK,AAAN,KAAK,CAAC,YAAY,CAAc,IAAY,EAAmC,KAAkB;QAC/F,MAAM,UAAU,GAAG,IAAA,2BAAa,EAAC,kBAAM,CAAC,CAAA;QACxC,MAAM,MAAM,GAAW,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QAE3D,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC,MAAM,CAAA;QACrB,CAAC;QAED,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC;YAC3B,GAAG,MAAM;YACT,GAAG,KAAK;SACF,CAAC,CAAA;IACX,CAAC;IAOK,AAAN,KAAK,CAAC,aAAa,CAAsC,OAAsB;QAC7E,MAAM,UAAU,GAAuB,IAAA,2BAAa,EAAC,kBAAM,CAAC,CAAA;QAE5D,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAU,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAEzD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,8DAA8D;YAC9D,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAC,YAAY,EAAC,EAAE;gBAChC,MAAM,MAAM,GAAW,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;gBAEnF,wEAAwE;gBACxE,8DAA8D;gBAC9D,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;oBAC3B,YAAY,CAAC,SAAS,GAAG,IAAA,eAAO,EAAC,YAAY,CAAC,SAAS,CAAC,CAAA;oBACxD,IAAI,YAAY,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;wBAChD,oCAAoC;wBACpC,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;4BACvD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;wBAC/D,CAAC;wBACD,2CAA2C;wBAC3C,IAAI,YAAY,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;4BACxC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;wBAC3E,CAAC;wBACD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,CAAA;wBAC7E,IAAI,GAAG,IAAI,GAAG,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;4BAChC,MAAM,IAAI,KAAK,CAAC,cAAc,YAAY,CAAC,SAAS,sBAAsB,CAAC,CAAA;wBAC7E,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,OAAO,YAAY,CAAC,SAAS,CAAA;gBAC/B,CAAC;gBAED,IAAI,YAAY,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;oBAC/D,OAAO,YAAY,CAAC,MAAM,CAAA;gBAC5B,CAAC;gBAED,MAAM,UAAU,CAAC,IAAI,CAAC;oBACpB,GAAG,MAAM;oBACT,GAAG,YAAY;iBACT,CAAC,CAAA;YACX,CAAC,CAAC,CACH,CAAA;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,kBAAkB,CACe,MAAc,EAC5C,OAAY;QAEnB,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAChC,MAAM,UAAU,GAAG,IAAA,2BAAa,EAAC,kBAAM,CAAC,CAAA;QAExC,IAAA,iCAAe,EAAC,MAAM,CAAC,CAAA;QAEvB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC;YAC/C,GAAG,MAAM;YACT,MAAM;SACA,CAAC,CAAA;QAET,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AA7IY,wCAAc;AAOnB;IANL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,wBAAS,EAAC,oCAAoC,CAAC;IAC/C,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,kBAAM,EAAE;QAC3B,WAAW,EACT,8IAA8I;KACjJ,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,aAAa,EAAE,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC,CAAA;;6CAAc,6BAAW;;kDAYrH;AAQK;IANL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,wBAAS,EAAC,oCAAoC,CAAC;IAC/C,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,kBAAM,EAAE;QAC3B,WAAW,EACT,oIAAoI;KACvI,CAAC;IACkB,mBAAA,IAAA,kBAAG,EAAC,MAAM,EAAE,EAAE,WAAW,EAAE,mCAAmC,EAAE,CAAC,CAAA;;;;kDAEpF;AAQK;IANL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,wBAAS,EAAC,oCAAoC,CAAC;IAC/C,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,mJAAmJ;KACtJ,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC,CAAA;;;;mDAMtF;AAOK;IALL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,wBAAS,EAAC,oCAAoC,CAAC;IAC/C,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,kBAAM,EAAE;QAC3B,WAAW,EAAE,8DAA8D;KAC5E,CAAC;IACkB,mBAAA,IAAA,kBAAG,EAAC,MAAM,CAAC,CAAA;IAAgB,mBAAA,IAAA,kBAAG,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,6BAAW,CAAC,CAAA;;qDAAQ,6BAAW;;kDAYhG;AAOK;IALL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,wBAAS,EAAC,oCAAoC,CAAC;IAC/C,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EAAE,wEAAwE;KACtF,CAAC;IACmB,mBAAA,IAAA,kBAAG,EAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,6BAAW,CAAC,CAAC,CAAA;;;;mDA8CvD;AAQK;IANL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,wBAAS,EACR,2GAA2G,CAC5G;IACA,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,+BAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;IACzG,IAAA,4BAAa,EAAC,0BAAa,CAAC;IAE1B,mBAAA,IAAA,kBAAG,EAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,+BAAY,CAAC,CAAA;IACnC,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;wDAaP;yBA5IU,cAAc;IAD1B,IAAA,uBAAQ,EAAC,kBAAM,CAAC;GACJ,cAAc,CA6I1B","sourcesContent":["import { Arg, Args, Ctx, Directive, Mutation, Query, Resolver, Root, UseMiddleware } from 'type-graphql'\nimport { In, Repository } from 'typeorm'\n\nimport { slugger } from '@things-factory/utils'\n\nimport { getRepository } from '../../initializers/database.js'\n\nimport { Domain, IPList } from './domain.js'\nimport { DomainPatch } from './domain-types.js'\nimport { ScalarObject } from '../common-types/scalar-object.js'\nimport { refuseBadIPList } from '../../middlewares/ip-list-rule.js'\nimport { SpeakRefusals } from '../../refusal/refusal.js'\n\n@Resolver(Domain)\nexport class DomainMutation {\n  @Directive('@transaction')\n  @Directive('@privilege(superUserGranted: true)')\n  @Mutation(returns => Domain, {\n    description:\n      'Creates a new domain entity. Only superusers are granted this privilege. Use this mutation to register a new domain with a unique subdomain.'\n  })\n  async createDomain(\n    @Arg('domainInput', { description: 'The input object containing the new domain details.' }) domainInput: DomainPatch\n  ) {\n    const { name, description } = domainInput\n    const domainRepo: Repository<Domain> = getRepository(Domain)\n    const subdomain: string = slugger(name)\n\n    const domain: Domain = await domainRepo.findOneBy({ subdomain })\n    if (domain) {\n      throw new Error('domain is duplicated')\n    }\n\n    return await domainRepo.save({ name, description, subdomain })\n  }\n\n  @Directive('@transaction')\n  @Directive('@privilege(superUserGranted: true)')\n  @Mutation(returns => Domain, {\n    description:\n      'Deletes a domain entity by its name. Only superusers are granted this privilege. Use this mutation to permanently remove a domain.'\n  })\n  async deleteDomain(@Arg('name', { description: 'The name of the domain to delete.' }) name: string) {\n    return await getRepository(Domain).delete({ name })\n  }\n\n  @Directive('@transaction')\n  @Directive('@privilege(superUserGranted: true)')\n  @Mutation(returns => Boolean, {\n    description:\n      'Deletes multiple domain entities by their names. Only superusers are granted this privilege. Use this mutation to remove several domains at once.'\n  })\n  async deleteDomains(\n    @Arg('names', () => [String], { description: 'An array of domain names to delete.' }) names: string[]\n  ) {\n    const domains: Domain[] = await getRepository(Domain).find({ where: { name: In(names) } })\n    const domainIds: string[] = domains.map(domain => domain.id)\n\n    await getRepository(Domain).delete({ id: In(domainIds) })\n  }\n\n  @Directive('@transaction')\n  @Directive('@privilege(superUserGranted: true)')\n  @Mutation(returns => Domain, {\n    description: 'To update domain (Only superuser is granted this privilege.)'\n  })\n  async updateDomain(@Arg('name') name: string, @Arg('patch', () => DomainPatch) patch: DomainPatch) {\n    const repository = getRepository(Domain)\n    const domain: Domain = await repository.findOneBy({ name })\n\n    if (patch.parent && patch.parent.id == domain.id) {\n      delete patch.parent\n    }\n\n    return await repository.save({\n      ...domain,\n      ...patch\n    } as any)\n  }\n\n  @Directive('@transaction')\n  @Directive('@privilege(superUserGranted: true)')\n  @Mutation(returns => Boolean, {\n    description: 'To update multiple domains (Only superuser is granted this privilege.)'\n  })\n  async updateDomains(@Arg('patches', () => [DomainPatch]) patches: DomainPatch[]): Promise<boolean> {\n    const domainRepo: Repository<Domain> = getRepository(Domain)\n\n    const patchIds = patches.filter((patch: any) => patch.id)\n\n    if (patchIds.length > 0) {\n      /* 모든 저장을 await 해야 @transaction 스코프 안에서 커밋되고 에러가 호출자에 전파된다. */\n      await Promise.all(\n        patchIds.map(async updateRecord => {\n          const domain: Domain = await domainRepo.findOne({ where: { id: updateRecord.id } })\n\n          // 1. 도메인명(name)만 변경할 때는 slugger로 subdomain을 덮어쓰지 않는다 (기존 subdomain 유지).\n          // 2. subdomain이 명시적으로 패치에 포함된 경우에만 slugger를 적용하고 중복 검사를 수행한다.\n          if (updateRecord.subdomain) {\n            updateRecord.subdomain = slugger(updateRecord.subdomain)\n            if (updateRecord.subdomain !== domain.subdomain) {\n              // 'system' 도메인의 서브도메인은 절대 변경할 수 없다.\n              if (domain.subdomain === 'system' || domain.systemFlag) {\n                throw new Error(\"The 'system' subdomain cannot be modified.\")\n              }\n              // 'system' 서브도메인은 예약어이므로 다른 도메인이 차지할 수 없다.\n              if (updateRecord.subdomain === 'system') {\n                throw new Error(\"The subdomain 'system' is reserved and cannot be used.\")\n              }\n              const dup = await domainRepo.findOneBy({ subdomain: updateRecord.subdomain })\n              if (dup && dup.id !== domain.id) {\n                throw new Error(`Subdomain '${updateRecord.subdomain}' is already in use.`)\n              }\n            }\n          } else {\n            delete updateRecord.subdomain\n          }\n\n          if (updateRecord.parent && updateRecord.parent.id == domain.id) {\n            delete updateRecord.parent\n          }\n\n          await domainRepo.save({\n            ...domain,\n            ...updateRecord\n          } as any)\n        })\n      )\n    }\n\n    return true\n  }\n\n  @Directive('@transaction')\n  @Directive(\n    '@privilege(category: \"security\", privilege: \"mutation\", domainOwnerGranted: true, superUserGranted: true)'\n  )\n  @Mutation(returns => ScalarObject, { nullable: true, description: 'To update secure IP list for domain' })\n  @UseMiddleware(SpeakRefusals)\n  async updateSecureIPList(\n    @Arg('iplist', type => ScalarObject) iplist: IPList,\n    @Ctx() context: any\n  ): Promise<IPList | null> {\n    const { domain } = context.state\n    const repository = getRepository(Domain)\n\n    refuseBadIPList(iplist)\n\n    const { iplist: result } = await repository.save({\n      ...domain,\n      iplist\n    } as any)\n\n    return result\n  }\n}\n"]}