@uniorganization/uni-lib 4.1.4 → 4.1.5

package/dist/entities/user-roster.view.d.ts

@@ -62,9 +62,9 @@ export declare class VwUserRoster {
     phoenixId: string;
     five9Id: string;
     communityWfmId: string;
-    division: string;
+    divisionId: string | null;
     mainLine: string;
-    lob: string;
+    lobId: string | null;
     employeeRole: string;
     sector: string;
     sprinklrId: string;

package/dist/entities/user-roster.view.js

@@ -267,17 +267,17 @@ __decorate([
     __metadata("design:type", String)
 ], VwUserRoster.prototype, "communityWfmId", void 0);
 __decorate([
-    (0, typeorm_1.Column)({ name: 'division', type: 'text' }),
+    (0, typeorm_1.Column)({ name: 'division_id', type: 'bigint', nullable: true }),
     __metadata("design:type", String)
-], VwUserRoster.prototype, "division", void 0);
+], VwUserRoster.prototype, "divisionId", void 0);
 __decorate([
     (0, typeorm_1.Column)({ name: 'main_line', type: 'text' }),
     __metadata("design:type", String)
 ], VwUserRoster.prototype, "mainLine", void 0);
 __decorate([
-    (0, typeorm_1.Column)({ name: 'lob', type: 'text' }),
+    (0, typeorm_1.Column)({ name: 'lob_id', type: 'bigint', nullable: true }),
     __metadata("design:type", String)
-], VwUserRoster.prototype, "lob", void 0);
+], VwUserRoster.prototype, "lobId", void 0);
 __decorate([
     (0, typeorm_1.Column)({ name: 'employee_role', type: 'text' }),
     __metadata("design:type", String)

package/dist/entities/users-lobs.entity.d.ts

@@ -0,0 +1,11 @@
+import { Lob } from './lob.entity';
+import { Users } from './usr.entity';
+export declare class UsersLobs {
+    clientId: number;
+    userId: number;
+    lobId: string;
+    createdAt: Date;
+    updatedAt: Date;
+    user: Users;
+    lob: Lob;
+}

package/dist/entities/users-lobs.entity.js

@@ -0,0 +1,57 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UsersLobs = void 0;
+const typeorm_1 = require("typeorm");
+const lob_entity_1 = require("./lob.entity");
+const usr_entity_1 = require("./usr.entity");
+let UsersLobs = class UsersLobs {
+};
+exports.UsersLobs = UsersLobs;
+__decorate([
+    (0, typeorm_1.PrimaryColumn)({ name: 'client_id', type: 'integer' }),
+    __metadata("design:type", Number)
+], UsersLobs.prototype, "clientId", void 0);
+__decorate([
+    (0, typeorm_1.PrimaryColumn)({ name: 'user_id', type: 'numeric' }),
+    __metadata("design:type", Number)
+], UsersLobs.prototype, "userId", void 0);
+__decorate([
+    (0, typeorm_1.PrimaryColumn)({ name: 'lob_id', type: 'bigint' }),
+    __metadata("design:type", String)
+], UsersLobs.prototype, "lobId", void 0);
+__decorate([
+    (0, typeorm_1.CreateDateColumn)({ name: 'created_at', type: 'timestamptz' }),
+    __metadata("design:type", Date)
+], UsersLobs.prototype, "createdAt", void 0);
+__decorate([
+    (0, typeorm_1.UpdateDateColumn)({ name: 'updated_at', type: 'timestamptz' }),
+    __metadata("design:type", Date)
+], UsersLobs.prototype, "updatedAt", void 0);
+__decorate([
+    (0, typeorm_1.ManyToOne)(() => usr_entity_1.Users, (user) => user.usersLobs, { onDelete: 'CASCADE' }),
+    (0, typeorm_1.JoinColumn)([
+        { name: 'user_id', referencedColumnName: 'id' },
+        { name: 'client_id', referencedColumnName: 'clientId' },
+    ]),
+    __metadata("design:type", usr_entity_1.Users)
+], UsersLobs.prototype, "user", void 0);
+__decorate([
+    (0, typeorm_1.ManyToOne)(() => lob_entity_1.Lob, (lob) => lob.userLobs),
+    (0, typeorm_1.JoinColumn)([
+        { name: 'lob_id', referencedColumnName: 'id' },
+        { name: 'client_id', referencedColumnName: 'clientId' },
+    ]),
+    __metadata("design:type", lob_entity_1.Lob)
+], UsersLobs.prototype, "lob", void 0);
+exports.UsersLobs = UsersLobs = __decorate([
+    (0, typeorm_1.Entity)('users_lobs', { schema: 'stm' })
+], UsersLobs);

package/dist/entities/usr.entity.d.ts

@@ -2,8 +2,8 @@ import { Timestamp } from 'typeorm';
 import { UserCampaign } from './user-campaign.entity';
 import { UserRoles } from './user-roles.entity';
 import { RawRoster } from './raw_roster.entity';
+import { UsersLobs } from './users-lobs.entity';
 export declare class Users {
-    clientId: number;
     id: number;
     username: string;
     password: string;
@@ -25,6 +25,8 @@ export declare class Users {
     reportsTo: Users;
     userCampaigns: UserCampaign[];
     rawRoster: RawRoster;
+    usersLobs: UsersLobs[];
     fullName: string;
-    calculateFullName(): void;
+    applyDerivedScope(): void;
+    private firstLobDivision;
 }

package/dist/entities/usr.entity.js

@@ -14,16 +14,28 @@ const typeorm_1 = require("typeorm");
 const user_campaign_entity_1 = require("./user-campaign.entity");
 const user_roles_entity_1 = require("./user-roles.entity");
 const raw_roster_entity_1 = require("./raw_roster.entity");
+const users_lobs_entity_1 = require("./users-lobs.entity");
 let Users = class Users {
-    calculateFullName() {
+    applyDerivedScope() {
+        var _a;
         this.fullName = `${this.first_name} ${this.last_name}`;
+        const lobNames = ((_a = this.usersLobs) !== null && _a !== void 0 ? _a : [])
+            .map((assignment) => { var _a; return (_a = assignment.lob) === null || _a === void 0 ? void 0 : _a.name; })
+            .filter((name) => Boolean(name))
+            .sort((a, b) => a.localeCompare(b));
+        this.lob = lobNames.join(',');
+        this.division = lobNames.length > 0 ? this.firstLobDivision() : '';
+    }
+    firstLobDivision() {
+        var _a, _b;
+        const divisions = ((_a = this.usersLobs) !== null && _a !== void 0 ? _a : [])
+            .map((assignment) => { var _a, _b; return (_b = (_a = assignment.lob) === null || _a === void 0 ? void 0 : _a.division) === null || _b === void 0 ? void 0 : _b.name; })
+            .filter((name) => Boolean(name))
+            .sort((a, b) => a.localeCompare(b));
+        return (_b = divisions[0]) !== null && _b !== void 0 ? _b : '';
     }
 };
 exports.Users = Users;
-__decorate([
-    (0, typeorm_1.Column)({ name: 'client_id', type: 'integer' }),
-    __metadata("design:type", Number)
-], Users.prototype, "clientId", void 0);
 __decorate([
     (0, typeorm_1.PrimaryGeneratedColumn)({ name: 'ID' }),
     __metadata("design:type", Number)
@@ -72,14 +84,6 @@ __decorate([
     (0, typeorm_1.Column)({ length: 250, name: 'ntgid' }),
     __metadata("design:type", String)
 ], Users.prototype, "ntgid", void 0);
-__decorate([
-    (0, typeorm_1.Column)({ length: 250, name: 'lob' }),
-    __metadata("design:type", String)
-], Users.prototype, "lob", void 0);
-__decorate([
-    (0, typeorm_1.Column)({ length: 250, name: 'division' }),
-    __metadata("design:type", String)
-], Users.prototype, "division", void 0);
 __decorate([
     (0, typeorm_1.Column)({ length: 250, name: 'profile' }),
     __metadata("design:type", String)
@@ -114,12 +118,16 @@ __decorate([
     (0, typeorm_1.OneToOne)(() => raw_roster_entity_1.RawRoster, (rawRoster) => rawRoster.user),
     __metadata("design:type", raw_roster_entity_1.RawRoster)
 ], Users.prototype, "rawRoster", void 0);
+__decorate([
+    (0, typeorm_1.OneToMany)(() => users_lobs_entity_1.UsersLobs, (usersLobs) => usersLobs.user),
+    __metadata("design:type", Array)
+], Users.prototype, "usersLobs", void 0);
 __decorate([
     (0, typeorm_1.AfterLoad)(),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", []),
     __metadata("design:returntype", void 0)
-], Users.prototype, "calculateFullName", null);
+], Users.prototype, "applyDerivedScope", null);
 exports.Users = Users = __decorate([
     (0, typeorm_1.Entity)('USERS')
 ], Users);

package/dist/entities/vw-escalation-age.d.ts

@@ -4,6 +4,8 @@ export declare class VwEscalationAge {
     category: string;
     division: string;
     lob: string;
+    divisionId: string | null;
+    lobId: string | null;
     escalationStatus: string;
     zeroToThree: number;
     fourToSeven: number;

package/dist/entities/vw-escalation-age.js

@@ -34,6 +34,14 @@ __decorate([
     (0, typeorm_1.ViewColumn)(),
     __metadata("design:type", String)
 ], VwEscalationAge.prototype, "lob", void 0);
+__decorate([
+    (0, typeorm_1.ViewColumn)({ name: 'division_id' }),
+    __metadata("design:type", String)
+], VwEscalationAge.prototype, "divisionId", void 0);
+__decorate([
+    (0, typeorm_1.ViewColumn)({ name: 'lob_id' }),
+    __metadata("design:type", String)
+], VwEscalationAge.prototype, "lobId", void 0);
 __decorate([
     (0, typeorm_1.ViewColumn)(),
     __metadata("design:type", String)

package/dist/middlewares/index.d.ts

@@ -0,0 +1 @@
+export * from './version-checker.middleware';

package/dist/middlewares/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./version-checker.middleware"), exports);

package/dist/middlewares/version-checker.middleware.d.ts

@@ -0,0 +1,2 @@
+import { NextFunction, Request, Response } from 'express';
+export declare function versionChecker(req: Request, res: Response, next: NextFunction): Promise<Response<any, Record<string, any>>>;

package/dist/middlewares/version-checker.middleware.js

@@ -0,0 +1,27 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.versionChecker = versionChecker;
+const fs = require("fs/promises");
+const path = require("path");
+function versionChecker(req, res, next) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const version = (yield fs.readFile(path.join(process.cwd(), 'app-version.txt')))
+            .toString()
+            .trim();
+        if (req.headers['app-version'] !== version)
+            return res.status(409).json({
+                message: `You need to update the application version to ${version}`,
+                status: 409,
+            });
+        next();
+    });
+}

package/dist/modules/common/jwt.strategy.js

@@ -38,7 +38,6 @@ let JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(pas
             var _a, _b, _c;
             const signedUser = payload === null || payload === void 0 ? void 0 : payload.user;
             const effectiveClientId = Number(signedUser === null || signedUser === void 0 ? void 0 : signedUser.clientId);
-            const homeClientId = Number(signedUser === null || signedUser === void 0 ? void 0 : signedUser.homeClientId);
             const originalClientId = (_a = signedUser === null || signedUser === void 0 ? void 0 : signedUser.originalClientId) !== null && _a !== void 0 ? _a : null;
             const now = Math.floor(Date.now() / 1000);
             if ((payload === null || payload === void 0 ? void 0 : payload.type) !== 'access' ||
@@ -47,8 +46,6 @@ let JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(pas
                 String(signedUser.id) !== payload.sub ||
                 !Number.isInteger(effectiveClientId) ||
                 effectiveClientId <= 0 ||
-                !Number.isInteger(homeClientId) ||
-                homeClientId <= 0 ||
                 !Number.isInteger(payload.exp) ||
                 payload.exp <= now ||
                 !this.validTokenIdentifier(payload.jti) ||
@@ -62,7 +59,6 @@ let JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(pas
             const impersonating = originalClientId !== null;
             if ((impersonating &&
                 (originalClientId !== tenant_1.NEWTECH_CLIENT_ID ||
-                    homeClientId !== tenant_1.NEWTECH_CLIENT_ID ||
                     effectiveClientId === tenant_1.NEWTECH_CLIENT_ID ||
                     !((_b = signedUser.roles) === null || _b === void 0 ? void 0 : _b.includes(tenant_1.TENANT_IMPERSONATOR_ROLE)) ||
                     !signedUser.impersonatedAt ||
@@ -71,13 +67,14 @@ let JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(pas
                 throw new common_1.UnauthorizedException();
             }
             const resolved = impersonating
-                ? yield this.authorization.resolveImpersonation(signedUser.id, homeClientId, effectiveClientId)
-                : yield this.authorization.resolve(signedUser.id, effectiveClientId, homeClientId);
+                ? yield this.authorization.resolveImpersonation(signedUser.id, originalClientId, effectiveClientId)
+                : yield this.authorization.resolve(signedUser.id, effectiveClientId);
             const { identity, snapshot } = resolved;
             const isMasterTenantAdmin = !impersonating &&
                 snapshot.clientId === tenant_1.NEWTECH_CLIENT_ID &&
-                snapshot.roles.some((role) => role.moduleName.toLowerCase() === 'root' &&
-                    role.roleName.toLowerCase() === 'sysadmin');
+                (snapshot.permissions.includes('master.users.read') ||
+                    snapshot.roles.some((role) => role.moduleName.toLowerCase() === 'root' &&
+                        role.roleName.toLowerCase() === 'sysadmin'));
             return {
                 id: identity.id,
                 first_name: identity.firstName,
@@ -91,7 +88,6 @@ let JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(pas
                 password_expired: identity.passwordExpired,
                 viewEvaluations: identity.viewEvaluations,
                 ern: identity.ern,
-                homeClientId: identity.homeClientId,
                 clientId: snapshot.clientId,
                 clientAlias: snapshot.clientAlias,
                 clientName: snapshot.clientName,
@@ -104,6 +100,9 @@ let JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(pas
                     : null,
                 roles: Array.from(new Set(snapshot.roles.map((role) => role.roleName))),
                 privileges: snapshot.privileges,
+                role: snapshot.accessRole,
+                permissions: snapshot.permissions,
+                authzVersion: snapshot.authzVersion,
                 isMasterTenantAdmin,
             };
         });

package/dist/modules/common/jwt.strategy.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/common/jwt.strategy.spec.js

@@ -0,0 +1,89 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const common_1 = require("@nestjs/common");
+const tenant_1 = require("../tenant");
+const jwt_strategy_1 = require("./jwt.strategy");
+describe('JwtStrategy impersonated sessions', () => {
+    process.env.JWT_SECRET = 'test-secret';
+    const authorization = { resolveImpersonation: jest.fn() };
+    const securityState = { isAccessTokenRevoked: jest.fn() };
+    const strategy = new jwt_strategy_1.JwtStrategy(authorization, securityState);
+    const payload = (overrides = {}) => {
+        const now = Math.floor(Date.now() / 1000);
+        const expiresAt = now + 900;
+        const user = Object.assign({ id: 1, homeClientId: 2, clientId: 2, clientName: 'Altera', clientAlias: 'altera', jti: 'impersonated-jti', tokenExpiresAt: expiresAt, originalClientId: tenant_1.NEWTECH_CLIENT_ID, impersonatedAt: new Date().toISOString(), impersonationReason: 'Investigate issue', roles: [tenant_1.TENANT_IMPERSONATOR_ROLE], privileges: [], role: {
+                id: 0,
+                code: tenant_1.TENANT_IMPERSONATOR_ROLE,
+                name: 'Tenant impersonator',
+                scope: 'GLOBAL',
+                clientId: null,
+            }, permissions: [], authzVersion: 1, isMasterTenantAdmin: false }, overrides);
+        return {
+            type: 'access',
+            user,
+            sub: '1',
+            iat: now - 10,
+            exp: expiresAt,
+            jti: 'impersonated-jti',
+        };
+    };
+    beforeEach(() => {
+        jest.clearAllMocks();
+        securityState.isAccessTokenRevoked.mockResolvedValue(false);
+        authorization.resolveImpersonation.mockResolvedValue({
+            identity: { id: 1, homeClientId: 2 },
+            snapshot: {
+                userId: 1,
+                homeClientId: 2,
+                clientId: 2,
+                clientName: 'Altera',
+                clientAlias: 'altera',
+                roles: [
+                    {
+                        roleId: 0,
+                        roleName: tenant_1.TENANT_IMPERSONATOR_ROLE,
+                        moduleId: 0,
+                        moduleName: tenant_1.TENANT_IMPERSONATOR_ROLE,
+                    },
+                ],
+                privileges: [],
+                accessRole: {
+                    id: 0,
+                    code: tenant_1.TENANT_IMPERSONATOR_ROLE,
+                    name: 'Tenant impersonator',
+                    scope: 'GLOBAL',
+                    clientId: null,
+                },
+                permissions: [],
+                authzVersion: 1,
+                identity: { id: 1, homeClientId: 2 },
+                cachedAt: new Date().toISOString(),
+            },
+        });
+    });
+    it('revalidates an impersonated token with an Altera home client through Newtech', () => __awaiter(void 0, void 0, void 0, function* () {
+        const validated = yield strategy.validate(payload());
+        expect(authorization.resolveImpersonation).toHaveBeenCalledWith(1, 1, 2, 2);
+        expect(validated.homeClientId).toBe(2);
+        expect(validated.clientId).toBe(2);
+        expect(validated.originalClientId).toBe(tenant_1.NEWTECH_CLIENT_ID);
+    }));
+    const invalidTokenCases = [
+        [{ originalClientId: 2 }, 'a non-Newtech origin'],
+        [{ roles: [] }, 'a token without the impersonator role'],
+        [{ impersonationReason: null }, 'a token without a support reason'],
+    ];
+    it.each(invalidTokenCases)('rejects %s', (overrides) => __awaiter(void 0, void 0, void 0, function* () {
+        yield expect(strategy.validate(payload(overrides))).rejects.toBeInstanceOf(common_1.UnauthorizedException);
+        expect(authorization.resolveImpersonation).not.toHaveBeenCalled();
+    }));
+});

package/dist/modules/tenant/redis-tenant-state.store.js

@@ -138,8 +138,6 @@ let RedisTenantStateStore = RedisTenantStateStore_1 = class RedisTenantStateStor
         return Boolean(value &&
             Number.isInteger(value.userId) &&
             value.userId > 0 &&
-            Number.isInteger(value.homeClientId) &&
-            value.homeClientId > 0 &&
             Number.isInteger(value.clientId) &&
             value.clientId > 0 &&
             typeof value.clientName === 'string' &&
@@ -154,8 +152,17 @@ let RedisTenantStateStore = RedisTenantStateStore_1 = class RedisTenantStateStor
                 typeof role.moduleName === 'string') &&
             Array.isArray(value.privileges) &&
             value.privileges.every((privilege) => typeof privilege === 'string') &&
+            value.accessRole &&
+            Number.isInteger(value.accessRole.id) &&
+            value.accessRole.id >= 0 &&
+            typeof value.accessRole.code === 'string' &&
+            typeof value.accessRole.name === 'string' &&
+            ['GLOBAL', 'CLIENT'].includes(value.accessRole.scope) &&
+            Array.isArray(value.permissions) &&
+            value.permissions.every((permission) => typeof permission === 'string') &&
+            Number.isInteger(value.authzVersion) &&
+            value.authzVersion > 0 &&
             ((_a = value.identity) === null || _a === void 0 ? void 0 : _a.id) === value.userId &&
-            value.identity.homeClientId === value.homeClientId &&
             typeof value.cachedAt === 'string');
     }
 };

package/dist/modules/tenant/tenant-authorization.service.d.ts

@@ -12,8 +12,8 @@ export declare class TenantAuthorizationService {
     private readonly userRoleRepository;
     private readonly logger;
     constructor(store: TenantAuthorizationStore, userRepository: Repository<Users>, clientRepository: Repository<Client>, userRoleRepository: Repository<UserRoles>);
-    resolve(userId: number, clientId: number, expectedHomeClientId: number): Promise<ResolvedTenantAuthorization>;
-    resolveImpersonation(userId: number, homeClientId: number, targetClientId: number): Promise<ResolvedTenantAuthorization>;
+    resolve(userId: number, clientId: number, _legacyOriginClientId?: number): Promise<ResolvedTenantAuthorization>;
+    resolveImpersonation(userId: number, originClientId: number, targetClientIdOrLegacyOriginClientId: number, legacyTargetClientId?: number): Promise<ResolvedTenantAuthorization>;
     invalidate(userId: number, clientId: number): Promise<void>;
     invalidateMany(clientId: number, userIds: readonly number[]): Promise<void>;
     private loadFromDatabase;