@universis/janitor 2.4.4 → 2.5.1

package/README.md

@@ -440,6 +440,26 @@ add `scopeAccess` section under `settings/universis/janitor` configuration and s
 
 The given files should contain an array of scope access configuration elements as described in the `ScopeAccessConfiguration` section.
 
+## EnableReadAccessScope
+
+`EnableReadAccessScope` is an application service which enables read-only client scopes (`students:read`, `teachers:read` and `registrar:read`) alongside the default `students`, `teachers` and `registrar` scopes.
+
+Register service under application services:
+
+```json
+{
+    "services": [
+        {
+            "serviceType": "@universis/janitor#EnableReadAccessScope"
+        }
+    ]
+}
+```
+
+When the application container is ready, the service enumerates all model definitions and, for every scope-based privilege with read access (`mask: 1`) — at model or field level — which includes a client scope, it appends the corresponding `<scope>:read` scope. It also extends `ScopeAccessConfiguration` by inserting a read-only (`access: ["read"]`) element with the `<scope>:read` scope right after every element that grants read access to the original scope.
+
+This allows OAuth2 clients to request e.g. `students:read` and get read access to the same resources as `students`, without being able to modify them.
+
 
 ## RemoteAddressValidator
 

package/dist/index.d.ts

@@ -357,5 +357,10 @@ declare class DisableNetworkRestrictAccess extends NetworkRestrictAccess {
 
 declare function validateNetworkAccess(): Handler;
 
-export { AppRateLimitService, AppSpeedLimitService, DefaultScopeAccessConfiguration, DisableNetworkRestrictAccess, DisableUserClientScopeVerification, EnableNetworkRestrictAccess, EnableScopeAccessConfiguration, ExtendScopeAccessConfiguration, HttpBearerStrategy, HttpRemoteAddrForbiddenError, InvalidClientScopeError, NetworkRestrictAccess, OAuth2ClientService, OutputCachingService, PassportService, RateLimitService, RedisClientStore, RemoteAddressValidator, ScopeAccessConfiguration, ScopeString, SpeedLimitService, UserWithNetworkAddress, VerifyUserClientScope, outputCache, validateClientScope, validateNetworkAccess, validateScope };
+declare class EnableReadAccessScope extends ApplicationService {
+    readonly clientScopes: string[];
+    protected enable(clientScope: string): void;
+}
+
+export { AppRateLimitService, AppSpeedLimitService, DefaultScopeAccessConfiguration, DisableNetworkRestrictAccess, DisableUserClientScopeVerification, EnableNetworkRestrictAccess, EnableReadAccessScope, EnableScopeAccessConfiguration, ExtendScopeAccessConfiguration, HttpBearerStrategy, HttpRemoteAddrForbiddenError, InvalidClientScopeError, NetworkRestrictAccess, OAuth2ClientService, OutputCachingService, PassportService, RateLimitService, RedisClientStore, RemoteAddressValidator, ScopeAccessConfiguration, ScopeString, SpeedLimitService, UserWithNetworkAddress, VerifyUserClientScope, outputCache, validateClientScope, validateNetworkAccess, validateScope };
 export type { GenericUser, OAuth2AuthorizeUser, OAuth2MethodOptions, OAuth2ServiceSettings, OAuth2User, OAuth2UserProfile, OutputCachingElement, OutputCachingProfile, RateLimitServiceConfiguration, RateLimitStoreConstructor, ScopeAccessConfigurationElement, ScopeAccessConfigurationSection, SpeedLimitServiceConfiguration, SpeedLimitStoreConstructor, UniversisConfigurationSection };

package/dist/index.esm.js

@@ -1929,5 +1929,155 @@ class DisableNetworkRestrictAccess extends NetworkRestrictAccess {
   }
 }
 
-export { AppRateLimitService, AppSpeedLimitService, DefaultScopeAccessConfiguration, DisableNetworkRestrictAccess, DisableUserClientScopeVerification, EnableNetworkRestrictAccess, EnableScopeAccessConfiguration, ExtendScopeAccessConfiguration, HttpAccountDisabled, HttpBearerStrategy, HttpBearerTokenExpired, HttpBearerTokenNotFound, HttpBearerTokenRequired, HttpNetworkAccessForbiddenError, HttpRemoteAddrForbiddenError, InvalidClientScopeError, NetworkRestrictAccess, OAuth2ClientService, OutputCachingService, PassportService, RateLimitService, RedisClientStore, RemoteAddressValidator, ScopeAccessConfiguration, ScopeString, SpeedLimitService, UserWithNetworkAddress, VerifyUserClientScope, outputCache, validateClientScope, validateNetworkAddress, validateScope };
+class EnableReadAccessScope extends ApplicationService {
+  /**
+   *
+   * @param {import('@themost/express').ExpressDataApplication|import('@themost/common').ApplicationBase} app
+   */
+  constructor(app) {
+    super(app);
+    /**
+     * @type {import('rxjs').Observable<import('express').Application>}
+     */
+    const container = app && app.container;
+    if (container) {
+      container.subscribe((container) => {
+        if (container) {
+          for (const scope of this.clientScopes) {
+            this.enable(scope);
+          }
+        }
+      });
+    }
+  }
+
+  get clientScopes() {
+    return [
+    'students',
+    'teachers',
+    'registrar'];
+
+  }
+
+  /**
+   * @protected
+   * @param {string} scope
+   */
+  enable(scope) {
+    const searchScope = scope;
+    const targetScope = scope + ':read';
+    // get schema loader strategy for enumerating models
+    const schemaLoader = this.getApplication().getConfiguration().getStrategy(SchemaLoaderStrategy);
+    if (schemaLoader) {
+      const models = schemaLoader.getModels();
+      let updated = 0;
+      // enumerate models that includes scope based privileges
+      // where mask is 1 (read)
+      for (const model of models) {
+        /**
+         * @type {import('@themost/common').DataModelProperties}
+         */
+        const definition = schemaLoader.getModelDefinition(model);
+        if (Array.isArray(definition.privileges)) {
+          const privileges = definition.privileges.filter((item) => {
+            return item.mask === 1 && Array.isArray(item.scope) && item.scope.includes(searchScope);
+          });
+          let shouldUpdate = false;
+          if (privileges.length > 0) {
+            shouldUpdate = true;
+            // add target scope to privileges
+            for (const privilege of privileges) {
+              if (!privilege.scope.includes(targetScope)) {
+                privilege.scope.push(targetScope);
+              }
+            }
+          }
+          // get fields that includes scope based privileges
+          const fields = definition.fields.filter((item) => {
+            return Array.isArray(item.privileges);
+          }).filter((item) => {
+            const privileges = item.privileges.filter((privilege) => {
+              return privilege.mask === 1 && Array.isArray(privilege.scope) && privilege.scope.includes(searchScope);
+            });
+            return privileges.length > 0;
+          });
+          if (fields.length > 0) {
+            shouldUpdate = true;
+            for (const field of fields) {
+              const privileges = field.privileges.filter((privilege) => {
+                return privilege.mask === 1 && Array.isArray(privilege.scope) && privilege.scope.includes(searchScope);
+              });
+              for (const privilege of privileges) {
+                if (!privilege.scope.includes(targetScope)) {
+                  privilege.scope.push(targetScope);
+                }
+              }
+            }
+          }
+
+          // get views with scope based privileges
+          // noinspection JSUnresolvedReference
+          if (Array.isArray(definition.views)) {
+            // noinspection JSUnresolvedReference
+            const views = definition.views.filter((item) => {
+              return Array.isArray(item.privileges);
+            });
+            for (const view of views) {
+              const privileges = view.privileges.filter((privilege) => {
+                return privilege.mask === 1 && Array.isArray(privilege.scope) && privilege.scope.includes(searchScope);
+              });
+              if (privileges.length > 0) {
+                shouldUpdate = true;
+                for (const privilege of privileges) {
+                  if (!privilege.scope.includes(targetScope)) {
+                    privilege.scope.push(targetScope);
+                  }
+                }
+              }
+            }
+          }
+
+
+          if (shouldUpdate) {
+            updated++;
+            // update model definition
+            schemaLoader.setModelDefinition(definition);
+          }
+        }
+      }
+      if (updated > 0) {
+        TraceUtils.log(`${this.constructor.name}: Updated ${updated} model definition(s) to include scope "${targetScope}"`);
+      }
+    }
+
+    const scopeConfiguration = this.getApplication().getConfiguration().getStrategy(ScopeAccessConfiguration);
+    if (scopeConfiguration) {
+      const elements = scopeConfiguration.elements.
+      filter((item) => item.scope.includes(searchScope)).
+      filter((item) => item.access.includes('read'));
+      if (elements.length > 0) {
+        const insertElements = [];
+        for (const element of elements) {
+          insertElements.push({
+            insertAfter: element,
+            resource: element.resource,
+            scope: [targetScope],
+            access: ['read']
+          });
+        }
+        for (const { insertAfter, resource, scope, access } of insertElements) {
+          const index = scopeConfiguration.elements.findIndex((element) => element === insertAfter);
+          scopeConfiguration.elements.splice(index + 1, 0, {
+            resource,
+            scope,
+            access
+          });
+        }
+        TraceUtils.log(`${this.constructor.name}: Updated ${elements.length} scope access configuration(s) to include scope "${targetScope}"`);
+      }
+    }
+  }
+}
+
+export { AppRateLimitService, AppSpeedLimitService, DefaultScopeAccessConfiguration, DisableNetworkRestrictAccess, DisableUserClientScopeVerification, EnableNetworkRestrictAccess, EnableReadAccessScope, EnableScopeAccessConfiguration, ExtendScopeAccessConfiguration, HttpAccountDisabled, HttpBearerStrategy, HttpBearerTokenExpired, HttpBearerTokenNotFound, HttpBearerTokenRequired, HttpNetworkAccessForbiddenError, HttpRemoteAddrForbiddenError, InvalidClientScopeError, NetworkRestrictAccess, OAuth2ClientService, OutputCachingService, PassportService, RateLimitService, RedisClientStore, RemoteAddressValidator, ScopeAccessConfiguration, ScopeString, SpeedLimitService, UserWithNetworkAddress, VerifyUserClientScope, outputCache, validateClientScope, validateNetworkAddress, validateScope };
 //# sourceMappingURL=index.esm.js.map