@universis/janitor 2.5.0 → 2.5.1

package/README.md

@@ -440,6 +440,26 @@ add `scopeAccess` section under `settings/universis/janitor` configuration and s
 
 The given files should contain an array of scope access configuration elements as described in the `ScopeAccessConfiguration` section.
 
+## EnableReadAccessScope
+
+`EnableReadAccessScope` is an application service which enables read-only client scopes (`students:read`, `teachers:read` and `registrar:read`) alongside the default `students`, `teachers` and `registrar` scopes.
+
+Register service under application services:
+
+```json
+{
+    "services": [
+        {
+            "serviceType": "@universis/janitor#EnableReadAccessScope"
+        }
+    ]
+}
+```
+
+When the application container is ready, the service enumerates all model definitions and, for every scope-based privilege with read access (`mask: 1`) — at model or field level — which includes a client scope, it appends the corresponding `<scope>:read` scope. It also extends `ScopeAccessConfiguration` by inserting a read-only (`access: ["read"]`) element with the `<scope>:read` scope right after every element that grants read access to the original scope.
+
+This allows OAuth2 clients to request e.g. `students:read` and get read access to the same resources as `students`, without being able to modify them.
+
 
 ## RemoteAddressValidator
 

package/dist/index.esm.js

@@ -2014,6 +2014,30 @@ class EnableReadAccessScope extends ApplicationService {
               }
             }
           }
+
+          // get views with scope based privileges
+          // noinspection JSUnresolvedReference
+          if (Array.isArray(definition.views)) {
+            // noinspection JSUnresolvedReference
+            const views = definition.views.filter((item) => {
+              return Array.isArray(item.privileges);
+            });
+            for (const view of views) {
+              const privileges = view.privileges.filter((privilege) => {
+                return privilege.mask === 1 && Array.isArray(privilege.scope) && privilege.scope.includes(searchScope);
+              });
+              if (privileges.length > 0) {
+                shouldUpdate = true;
+                for (const privilege of privileges) {
+                  if (!privilege.scope.includes(targetScope)) {
+                    privilege.scope.push(targetScope);
+                  }
+                }
+              }
+            }
+          }
+
+
           if (shouldUpdate) {
             updated++;
             // update model definition