@uniorganization/uni-lib 4.1.4 → 4.2.0

package/dist/modules/common/jwt.strategy.js

@@ -76,8 +76,9 @@ let JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(pas
             const { identity, snapshot } = resolved;
             const isMasterTenantAdmin = !impersonating &&
                 snapshot.clientId === tenant_1.NEWTECH_CLIENT_ID &&
-                snapshot.roles.some((role) => role.moduleName.toLowerCase() === 'root' &&
-                    role.roleName.toLowerCase() === 'sysadmin');
+                (snapshot.permissions.includes('master.users.read') ||
+                    snapshot.roles.some((role) => role.moduleName.toLowerCase() === 'root' &&
+                        role.roleName.toLowerCase() === 'sysadmin'));
             return {
                 id: identity.id,
                 first_name: identity.firstName,
@@ -104,6 +105,9 @@ let JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(pas
                     : null,
                 roles: Array.from(new Set(snapshot.roles.map((role) => role.roleName))),
                 privileges: snapshot.privileges,
+                role: snapshot.accessRole,
+                permissions: snapshot.permissions,
+                authzVersion: snapshot.authzVersion,
                 isMasterTenantAdmin,
             };
         });

package/dist/modules/tenant/redis-tenant-state.store.js

@@ -154,6 +154,16 @@ let RedisTenantStateStore = RedisTenantStateStore_1 = class RedisTenantStateStor
                 typeof role.moduleName === 'string') &&
             Array.isArray(value.privileges) &&
             value.privileges.every((privilege) => typeof privilege === 'string') &&
+            value.accessRole &&
+            Number.isInteger(value.accessRole.id) &&
+            value.accessRole.id >= 0 &&
+            typeof value.accessRole.code === 'string' &&
+            typeof value.accessRole.name === 'string' &&
+            ['GLOBAL', 'CLIENT'].includes(value.accessRole.scope) &&
+            Array.isArray(value.permissions) &&
+            value.permissions.every((permission) => typeof permission === 'string') &&
+            Number.isInteger(value.authzVersion) &&
+            value.authzVersion > 0 &&
             ((_a = value.identity) === null || _a === void 0 ? void 0 : _a.id) === value.userId &&
             value.identity.homeClientId === value.homeClientId &&
             typeof value.cachedAt === 'string');

package/dist/modules/tenant/tenant-authorization.service.js

@@ -71,8 +71,9 @@ let TenantAuthorizationService = TenantAuthorizationService_1 = class TenantAuth
                 throw new common_1.UnauthorizedException();
             }
             const origin = yield this.resolve(userId, homeClientId, homeClientId);
-            const isNewtechMaster = origin.snapshot.roles.some((role) => role.moduleName.toLowerCase() === 'root' &&
-                role.roleName.toLowerCase() === 'sysadmin');
+            const isNewtechMaster = origin.snapshot.permissions.includes('master.users.read') ||
+                origin.snapshot.roles.some((role) => role.moduleName.toLowerCase() === 'root' &&
+                    role.roleName.toLowerCase() === 'sysadmin');
             const targetClient = yield this.clientRepository.findOne({
                 where: { id: targetClientId, deletedAt: (0, typeorm_2.IsNull)() },
             });
@@ -94,6 +95,15 @@ let TenantAuthorizationService = TenantAuthorizationService_1 = class TenantAuth
                     },
                 ],
                 privileges: [],
+                accessRole: {
+                    id: 0,
+                    code: tenant_constants_1.TENANT_IMPERSONATOR_ROLE,
+                    name: 'Tenant impersonator',
+                    scope: 'GLOBAL',
+                    clientId: null,
+                },
+                permissions: [],
+                authzVersion: 1,
                 identity: origin.identity,
                 cachedAt: new Date().toISOString(),
             };
@@ -115,7 +125,7 @@ let TenantAuthorizationService = TenantAuthorizationService_1 = class TenantAuth
     }
     loadFromDatabase(userId, clientId, expectedHomeClientId) {
         return __awaiter(this, void 0, void 0, function* () {
-            const [user, client, assignments] = yield Promise.all([
+            const [user, client, assignments, accessRows] = yield Promise.all([
                 this.userRepository.findOne({ where: { id: userId } }),
                 this.clientRepository.findOne({
                     where: { id: clientId, deletedAt: (0, typeorm_2.IsNull)() },
@@ -129,23 +139,64 @@ let TenantAuthorizationService = TenantAuthorizationService_1 = class TenantAuth
                     .where('assignment."USER_ID" = :userId', { userId })
                     .andWhere('assignment.client_id = :clientId', { clientId })
                     .getMany(),
+                this.userRoleRepository.manager.query(`SELECT
+           role.id,
+           role.code,
+           role.name,
+           role.scope,
+           role.client_id AS "roleClientId",
+           role.authz_version AS "authzVersion",
+           COALESCE(
+             jsonb_agg(permission.code ORDER BY permission.code)
+               FILTER (WHERE permission.id IS NOT NULL AND permission.is_active),
+             '[]'::jsonb
+           ) AS permissions
+         FROM stm."USER_ACCESS_ROLES" membership
+         JOIN stm."ACCESS_ROLES" role
+           ON role.id = membership.role_id
+          AND role.is_active
+         LEFT JOIN stm."ACCESS_ROLE_PERMISSIONS" definition
+           ON definition.role_id = role.id
+         LEFT JOIN stm."ACCESS_PERMISSIONS" permission
+           ON permission.id = definition.permission_id
+         WHERE membership.user_id = $1
+           AND membership.client_id = $2
+         GROUP BY role.id`, [userId, clientId]),
             ]);
             if (!user ||
                 !Number(user.is_active) ||
                 user.clientId !== expectedHomeClientId ||
                 !client ||
-                assignments.length === 0) {
+                accessRows.length !== 1) {
                 throw new common_1.UnauthorizedException();
             }
-            const roles = assignments.map((assignment) => {
-                var _a, _b, _c, _d, _e, _f;
-                return ({
-                    roleId: Number(assignment.roleId || ((_a = assignment.role) === null || _a === void 0 ? void 0 : _a.id)),
-                    roleName: (_b = assignment.role) === null || _b === void 0 ? void 0 : _b.roleName,
-                    moduleId: Number((_d = (_c = assignment.role) === null || _c === void 0 ? void 0 : _c.module) === null || _d === void 0 ? void 0 : _d.id),
-                    moduleName: (_f = (_e = assignment.role) === null || _e === void 0 ? void 0 : _e.module) === null || _f === void 0 ? void 0 : _f.moduleName,
-                });
-            });
+            const accessRow = accessRows[0];
+            const accessRole = {
+                id: Number(accessRow.id),
+                code: accessRow.code,
+                name: accessRow.name,
+                scope: accessRow.scope,
+                clientId: accessRow.roleClientId == null ? null : Number(accessRow.roleClientId),
+            };
+            const usingLegacyCompatibility = accessRole.code.startsWith('migrated-');
+            const roles = usingLegacyCompatibility && assignments.length
+                ? assignments.map((assignment) => {
+                    var _a, _b, _c, _d, _e, _f;
+                    return ({
+                        roleId: Number(assignment.roleId || ((_a = assignment.role) === null || _a === void 0 ? void 0 : _a.id)),
+                        roleName: (_b = assignment.role) === null || _b === void 0 ? void 0 : _b.roleName,
+                        moduleId: Number((_d = (_c = assignment.role) === null || _c === void 0 ? void 0 : _c.module) === null || _d === void 0 ? void 0 : _d.id),
+                        moduleName: (_f = (_e = assignment.role) === null || _e === void 0 ? void 0 : _e.module) === null || _f === void 0 ? void 0 : _f.moduleName,
+                    });
+                })
+                : [
+                    {
+                        roleId: accessRole.id,
+                        roleName: accessRole.name,
+                        moduleId: accessRole.id,
+                        moduleName: 'access-control',
+                    },
+                ];
             if (roles.some((role) => !Number.isInteger(role.roleId) ||
                 role.roleId <= 0 ||
                 !role.roleName ||
@@ -154,12 +205,14 @@ let TenantAuthorizationService = TenantAuthorizationService_1 = class TenantAuth
                 !role.moduleName)) {
                 throw new common_1.UnauthorizedException();
             }
-            const privileges = Array.from(new Set(assignments.flatMap((assignment) => {
-                var _a;
-                return (((_a = assignment.role) === null || _a === void 0 ? void 0 : _a.privileges) || [])
-                    .map((definition) => { var _a; return (_a = definition.privilege) === null || _a === void 0 ? void 0 : _a.privilege; })
-                    .filter((privilege) => Boolean(privilege));
-            }))).sort();
+            const privileges = usingLegacyCompatibility
+                ? Array.from(new Set(assignments.flatMap((assignment) => {
+                    var _a;
+                    return (((_a = assignment.role) === null || _a === void 0 ? void 0 : _a.privileges) || [])
+                        .map((definition) => { var _a; return (_a = definition.privilege) === null || _a === void 0 ? void 0 : _a.privilege; })
+                        .filter((privilege) => Boolean(privilege));
+                }))).sort()
+                : [];
             const identity = {
                 id: user.id,
                 homeClientId: user.clientId,
@@ -183,6 +236,11 @@ let TenantAuthorizationService = TenantAuthorizationService_1 = class TenantAuth
                 clientAlias: client.alias,
                 roles,
                 privileges,
+                accessRole,
+                permissions: Array.isArray(accessRow.permissions)
+                    ? accessRow.permissions
+                    : [],
+                authzVersion: Number(accessRow.authzVersion),
                 identity,
                 cachedAt: new Date().toISOString(),
             };

package/dist/modules/tenant/tenant-authorization.types.d.ts

@@ -12,9 +12,19 @@ export interface TenantAuthorizationSnapshot {
     clientAlias: string;
     roles: TenantRoleAuthorization[];
     privileges: string[];
+    accessRole: TenantAccessRoleAuthorization;
+    permissions: string[];
+    authzVersion: number;
     identity: TenantAuthorizationIdentity;
     cachedAt: string;
 }
+export interface TenantAccessRoleAuthorization {
+    id: number;
+    code: string;
+    name: string;
+    scope: 'GLOBAL' | 'CLIENT';
+    clientId: number | null;
+}
 export interface TenantAuthorizationIdentity {
     id: number;
     homeClientId: number;

package/dist/modules/tenant/tenant.types.d.ts

@@ -23,6 +23,15 @@ export interface AuthenticatedTenantUser {
     impersonationReason: string | null;
     roles: string[];
     privileges: string[];
+    role: {
+        id: number;
+        code: string;
+        name: string;
+        scope: 'GLOBAL' | 'CLIENT';
+        clientId: number | null;
+    };
+    permissions: string[];
+    authzVersion: number;
     isMasterTenantAdmin: boolean;
     first_name?: string;
     username?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uniorganization/uni-lib",
-  "version": "4.1.4",
+  "version": "4.2.0",
   "description": "UNI Library",
   "author": "Jhomiguel",
   "main": "dist/index.js",