@vitnode/core 1.2.0-canary.75 → 1.2.0-canary.76

package/dist/src/api/modules/admin/staff/routes/update-permissions.route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update-permissions.route.d.ts","sourceRoot":"","sources":["../../../../../../../src/api/modules/admin/staff/routes/update-permissions.route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAC;AA2BtC,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2K3C,CAAC"}
+{"version":3,"file":"update-permissions.route.d.ts","names":[],"sources":["../../../../../../../src/api/modules/admin/staff/routes/update-permissions.route.ts"],"mappings":";;;cA2Ba"}

package/dist/src/api/modules/admin/staff/routes/update-permissions.route.js

@@ -1 +1,2 @@
-import{z}from"@hono/zod-openapi";import{eq}from"drizzle-orm";import{HTTPException}from"hono/http-exception";import{assertStaffPermission,getUserRoleIds}from"../../../../lib/check-staff-permission.js";import{buildRoute}from"../../../../lib/route.js";import{staffPermissionKey}from"../../../../lib/staff-permission.js";import{CONFIG_PLUGIN}from"../../../../../config.js";import{core_admin_permissions}from"../../../../../database/admins.js";import{core_moderators_permissions}from"../../../../../database/moderators.js";import{permissionsStaffArgsSchema,staffPermissionModuleByType,staffTypeSchema}from"../lib/schema.js";const tableByType={admin:core_admin_permissions,moderator:core_moderators_permissions};export const updatePermissionsStaffAdminRoute=buildRoute({pluginId:CONFIG_PLUGIN.pluginId,route:{method:"patch",description:"Update the granted permissions of a staff entry (Admin only)",path:"/entry/{type}/{id}",request:{params:z.object({type:staffTypeSchema,id:z.string().openapi({example:"1"})}),body:{content:{"application/json":{schema:z.object({unrestricted:z.boolean(),permissions:z.array(permissionsStaffArgsSchema)})}}}},responses:{200:{content:{"application/json":{schema:z.object({unrestricted:z.boolean(),permissions:z.array(permissionsStaffArgsSchema)})}},description:"Updated permissions"},403:{description:"Access Denied"},404:{content:{"application/json":{schema:z.object({error:z.string()})}},description:"Staff entry not found"}}},handler:async c=>{const{type,id}=c.req.valid("param");await assertStaffPermission(c,{type:"admin",plugin:CONFIG_PLUGIN.pluginId,module:staffPermissionModuleByType[type],permission:"can_edit"});const{unrestricted,permissions}=c.req.valid("json");const entryId=Number(id);if(!Number.isInteger(entryId)){return c.json({error:"Staff entry not found"},404)}const table=tableByType[type];const[entry]=await c.get("db").select({protected:table.protected,userId:table.userId,roleId:table.roleId}).from(table).where(eq(table.id,entryId)).limit(1);if(!entry){return c.json({error:"Staff entry not found"},404)}if(entry.protected){throw new HTTPException(403,{message:"Forbidden"})}const currentUser=c.get("admin")?.user;const currentUserRoleIds=currentUser?await getUserRoleIds(c,currentUser):[];const isSelf=currentUser!=null&&(entry.userId!=null&&entry.userId===currentUser.id||entry.roleId!=null&&currentUserRoleIds.includes(entry.roleId));if(isSelf){throw new HTTPException(403,{message:"You cannot edit your own staff permissions."})}const allowed=new Set;const dependencies=new Map;for(const plugin of c.get("core").permissionStaff){for(const[module,modulePermissions]of Object.entries(plugin[type])){for(const entry of modulePermissions){const key=staffPermissionKey({plugin:plugin.pluginId,module,permission:entry.permission});allowed.add(key);dependencies.set(key,entry.dependsOn.map(dependency=>staffPermissionKey({plugin:plugin.pluginId,module,permission:dependency})))}}}const seen=new Set;const granted=new Map;if(!unrestricted){for(const permission of permissions){const key=staffPermissionKey(permission);if(!allowed.has(key)||seen.has(key))continue;seen.add(key);granted.set(key,permission)}let changed=true;while(changed){changed=false;for(const key of granted.keys()){const deps=dependencies.get(key)??[];if(deps.some(dependency=>!granted.has(dependency))){granted.delete(key);changed=true}}}}const sanitized=[...granted.values()];const[updated]=await c.get("db").update(table).set({data:{unrestricted,permissions:sanitized}}).where(eq(table.id,entryId)).returning({id:table.id});if(!updated){return c.json({error:"Staff entry not found"},404)}return c.json({unrestricted,permissions:sanitized},200)}});
+import{CONFIG_PLUGIN as e}from"../../../../../config.js";import{core_admin_permissions as t}from"../../../../../database/admins.js";import{core_moderators_permissions as n}from"../../../../../database/moderators.js";import{staffPermissionKey as r}from"../../../../lib/staff-permission.js";import{assertStaffPermission as i,getUserRoleIds as a}from"../../../../lib/check-staff-permission.js";import{buildRoute as o}from"../../../../lib/route.js";import{permissionsStaffArgsSchema as s,staffPermissionModuleByType as c,staffTypeSchema as l}from"../lib/schema.js";import{HTTPException as u}from"hono/http-exception";import{z as d}from"@hono/zod-openapi";import{eq as f}from"drizzle-orm";const p={admin:t,moderator:n},m=o({pluginId:e.pluginId,route:{method:`patch`,description:`Update the granted permissions of a staff entry (Admin only)`,path:`/entry/{type}/{id}`,request:{params:d.object({type:l,id:d.string().openapi({example:`1`})}),body:{content:{"application/json":{schema:d.object({unrestricted:d.boolean(),permissions:d.array(s)})}}}},responses:{200:{content:{"application/json":{schema:d.object({unrestricted:d.boolean(),permissions:d.array(s)})}},description:`Updated permissions`},403:{description:`Access Denied`},404:{content:{"application/json":{schema:d.object({error:d.string()})}},description:`Staff entry not found`}}},handler:async t=>{let{type:n,id:o}=t.req.valid(`param`);await i(t,{type:`admin`,plugin:e.pluginId,module:c[n],permission:`can_edit`});let{unrestricted:s,permissions:l}=t.req.valid(`json`),d=Number(o);if(!Number.isInteger(d))return t.json({error:`Staff entry not found`},404);let m=p[n],[h]=await t.get(`db`).select({protected:m.protected,userId:m.userId,roleId:m.roleId}).from(m).where(f(m.id,d)).limit(1);if(!h)return t.json({error:`Staff entry not found`},404);if(h.protected)throw new u(403,{message:`Forbidden`});let g=t.get(`admin`)?.user,_=g?await a(t,g):[];if(g!=null&&(h.userId!=null&&h.userId===g.id||h.roleId!=null&&_.includes(h.roleId)))throw new u(403,{message:`You cannot edit your own staff permissions.`});let v=new Set,y=new Map;for(let e of t.get(`core`).permissionStaff)for(let[t,i]of Object.entries(e[n]))for(let n of i){let i=r({plugin:e.pluginId,module:t,permission:n.permission});v.add(i),y.set(i,n.dependsOn.map(n=>r({plugin:e.pluginId,module:t,permission:n})))}let b=new Set,x=new Map;if(!s){for(let e of l){let t=r(e);!v.has(t)||b.has(t)||(b.add(t),x.set(t,e))}let e=!0;for(;e;){e=!1;for(let t of x.keys())(y.get(t)??[]).some(e=>!x.has(e))&&(x.delete(t),e=!0)}}let S=[...x.values()],[C]=await t.get(`db`).update(m).set({data:{unrestricted:s,permissions:S}}).where(f(m.id,d)).returning({id:m.id});return C?t.json({unrestricted:s,permissions:S},200):t.json({error:`Staff entry not found`},404)}});export{m as updatePermissionsStaffAdminRoute};
+//# sourceMappingURL=update-permissions.route.js.map

package/dist/src/api/modules/admin/staff/routes/update-permissions.route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-permissions.route.js","names":[],"sources":["../../../../../../../src/api/modules/admin/staff/routes/update-permissions.route.ts"],"sourcesContent":["import { z } from \"@hono/zod-openapi\";\nimport { eq } from \"drizzle-orm\";\nimport { HTTPException } from \"hono/http-exception\";\n\nimport type { PermissionsStaffArgs } from \"@/api/lib/permission-staff\";\n\nimport {\n  assertStaffPermission,\n  getUserRoleIds,\n} from \"@/api/lib/check-staff-permission\";\nimport { buildRoute } from \"@/api/lib/route\";\nimport { staffPermissionKey } from \"@/api/lib/staff-permission\";\nimport { CONFIG_PLUGIN } from \"@/config\";\nimport { core_admin_permissions } from \"@/database/admins\";\nimport { core_moderators_permissions } from \"@/database/moderators\";\n\nimport {\n  permissionsStaffArgsSchema,\n  staffPermissionModuleByType,\n  staffTypeSchema,\n} from \"../lib/schema\";\n\nconst tableByType = {\n  admin: core_admin_permissions,\n  moderator: core_moderators_permissions,\n} as const;\n\nexport const updatePermissionsStaffAdminRoute = buildRoute({\n  pluginId: CONFIG_PLUGIN.pluginId,\n  route: {\n    method: \"patch\",\n    description: \"Update the granted permissions of a staff entry (Admin only)\",\n    path: \"/entry/{type}/{id}\",\n    request: {\n      params: z.object({\n        type: staffTypeSchema,\n        id: z.string().openapi({ example: \"1\" }),\n      }),\n      body: {\n        content: {\n          \"application/json\": {\n            schema: z.object({\n              unrestricted: z.boolean(),\n              permissions: z.array(permissionsStaffArgsSchema),\n            }),\n          },\n        },\n      },\n    },\n    responses: {\n      200: {\n        content: {\n          \"application/json\": {\n            schema: z.object({\n              unrestricted: z.boolean(),\n              permissions: z.array(permissionsStaffArgsSchema),\n            }),\n          },\n        },\n        description: \"Updated permissions\",\n      },\n      403: {\n        description: \"Access Denied\",\n      },\n      404: {\n        content: {\n          \"application/json\": {\n            schema: z.object({ error: z.string() }),\n          },\n        },\n        description: \"Staff entry not found\",\n      },\n    },\n  },\n  handler: async c => {\n    const { type, id } = c.req.valid(\"param\");\n    await assertStaffPermission(c, {\n      type: \"admin\",\n      plugin: CONFIG_PLUGIN.pluginId,\n      module: staffPermissionModuleByType[type],\n      permission: \"can_edit\",\n    });\n\n    const { unrestricted, permissions } = c.req.valid(\"json\");\n\n    const entryId = Number(id);\n    if (!Number.isInteger(entryId)) {\n      return c.json({ error: \"Staff entry not found\" }, 404);\n    }\n\n    const table = tableByType[type];\n\n    const [entry] = await c\n      .get(\"db\")\n      .select({\n        protected: table.protected,\n        userId: table.userId,\n        roleId: table.roleId,\n      })\n      .from(table)\n      .where(eq(table.id, entryId))\n      .limit(1);\n\n    if (!entry) {\n      return c.json({ error: \"Staff entry not found\" }, 404);\n    }\n    // Protected entries are managed by the system and cannot be edited.\n    if (entry.protected) {\n      throw new HTTPException(403, { message: \"Forbidden\" });\n    }\n\n    // An admin cannot edit the entry that governs their own access - their own\n    // user entry or an entry for any role they belong to (primary or\n    // secondary). This stops them from escalating their own permissions.\n    const currentUser = c.get(\"admin\")?.user;\n    const currentUserRoleIds = currentUser\n      ? await getUserRoleIds(c, currentUser)\n      : [];\n    const isSelf =\n      currentUser != null &&\n      ((entry.userId != null && entry.userId === currentUser.id) ||\n        (entry.roleId != null && currentUserRoleIds.includes(entry.roleId)));\n    if (isSelf) {\n      throw new HTTPException(403, {\n        message: \"You cannot edit your own staff permissions.\",\n      });\n    }\n\n    // Only persist permissions that actually exist in the catalog for this\n    // staff type - silently drops anything unknown/forged. Also record each\n    // permission's dependencies (the keys of the permissions it `dependsOn`\n    // within the same module) so we can drop grants whose gate is missing.\n    const allowed = new Set<string>();\n    const dependencies = new Map<string, string[]>();\n    for (const plugin of c.get(\"core\").permissionStaff) {\n      for (const [module, modulePermissions] of Object.entries(plugin[type])) {\n        for (const entry of modulePermissions) {\n          const key = staffPermissionKey({\n            plugin: plugin.pluginId,\n            module,\n            permission: entry.permission,\n          });\n          allowed.add(key);\n          dependencies.set(\n            key,\n            entry.dependsOn.map(dependency =>\n              staffPermissionKey({\n                plugin: plugin.pluginId,\n                module,\n                permission: dependency,\n              }),\n            ),\n          );\n        }\n      }\n    }\n\n    const seen = new Set<string>();\n    const granted = new Map<string, PermissionsStaffArgs>();\n    // When unrestricted, the explicit list is irrelevant - store none.\n    if (!unrestricted) {\n      for (const permission of permissions) {\n        const key = staffPermissionKey(permission);\n        if (!allowed.has(key) || seen.has(key)) continue;\n        seen.add(key);\n        granted.set(key, permission);\n      }\n\n      // Drop any granted permission whose dependencies aren't all granted too,\n      // repeating until stable so a broken chain (a → b → c) collapses fully.\n      let changed = true;\n      while (changed) {\n        changed = false;\n        for (const key of granted.keys()) {\n          const deps = dependencies.get(key) ?? [];\n          if (deps.some(dependency => !granted.has(dependency))) {\n            granted.delete(key);\n            changed = true;\n          }\n        }\n      }\n    }\n\n    const sanitized: PermissionsStaffArgs[] = [...granted.values()];\n\n    const [updated] = await c\n      .get(\"db\")\n      .update(table)\n      .set({ data: { unrestricted, permissions: sanitized } })\n      .where(eq(table.id, entryId))\n      .returning({ id: table.id });\n\n    if (!updated) {\n      return c.json({ error: \"Staff entry not found\" }, 404);\n    }\n\n    return c.json({ unrestricted, permissions: sanitized }, 200);\n  },\n});\n"],"mappings":"4qBAsBA,MAAM,EAAc,CAClB,MAAO,EACP,UAAW,CACb,EAEa,EAAmC,EAAW,CACzD,SAAU,EAAc,SACxB,MAAO,CACL,OAAQ,QACR,YAAa,+DACb,KAAM,qBACN,QAAS,CACP,OAAQ,EAAE,OAAO,CACf,KAAM,EACN,GAAI,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAE,QAAS,GAAI,CAAC,CACzC,CAAC,EACD,KAAM,CACJ,QAAS,CACP,mBAAoB,CAClB,OAAQ,EAAE,OAAO,CACf,aAAc,EAAE,QAAQ,EACxB,YAAa,EAAE,MAAM,CAA0B,CACjD,CAAC,CACH,CACF,CACF,CACF,EACA,UAAW,CACT,IAAK,CACH,QAAS,CACP,mBAAoB,CAClB,OAAQ,EAAE,OAAO,CACf,aAAc,EAAE,QAAQ,EACxB,YAAa,EAAE,MAAM,CAA0B,CACjD,CAAC,CACH,CACF,EACA,YAAa,qBACf,EACA,IAAK,CACH,YAAa,eACf,EACA,IAAK,CACH,QAAS,CACP,mBAAoB,CAClB,OAAQ,EAAE,OAAO,CAAE,MAAO,EAAE,OAAO,CAAE,CAAC,CACxC,CACF,EACA,YAAa,uBACf,CACF,CACF,EACA,QAAS,KAAM,IAAK,CAClB,GAAM,CAAE,OAAM,MAAO,EAAE,IAAI,MAAM,OAAO,EACxC,MAAM,EAAsB,EAAG,CAC7B,KAAM,QACN,OAAQ,EAAc,SACtB,OAAQ,EAA4B,GACpC,WAAY,UACd,CAAC,EAED,GAAM,CAAE,eAAc,eAAgB,EAAE,IAAI,MAAM,MAAM,EAElD,EAAU,OAAO,CAAE,EACzB,GAAI,CAAC,OAAO,UAAU,CAAO,EAC3B,OAAO,EAAE,KAAK,CAAE,MAAO,uBAAwB,EAAG,GAAG,EAGvD,IAAM,EAAQ,EAAY,GAEpB,CAAC,GAAS,MAAM,EACnB,IAAI,IAAI,CAAC,CACT,OAAO,CACN,UAAW,EAAM,UACjB,OAAQ,EAAM,OACd,OAAQ,EAAM,MAChB,CAAC,CAAC,CACD,KAAK,CAAK,CAAC,CACX,MAAM,EAAG,EAAM,GAAI,CAAO,CAAC,CAAC,CAC5B,MAAM,CAAC,EAEV,GAAI,CAAC,EACH,OAAO,EAAE,KAAK,CAAE,MAAO,uBAAwB,EAAG,GAAG,EAGvD,GAAI,EAAM,UACR,MAAM,IAAI,EAAc,IAAK,CAAE,QAAS,WAAY,CAAC,EAMvD,IAAM,EAAc,EAAE,IAAI,OAAO,CAAC,EAAE,KAC9B,EAAqB,EACvB,MAAM,EAAe,EAAG,CAAW,EACnC,CAAC,EAKL,GAHE,GAAe,OACb,EAAM,QAAU,MAAQ,EAAM,SAAW,EAAY,IACpD,EAAM,QAAU,MAAQ,EAAmB,SAAS,EAAM,MAAM,GAEnE,MAAM,IAAI,EAAc,IAAK,CAC3B,QAAS,6CACX,CAAC,EAOH,IAAM,EAAU,IAAI,IACd,EAAe,IAAI,IACzB,IAAK,IAAM,KAAU,EAAE,IAAI,MAAM,CAAC,CAAC,gBACjC,IAAK,GAAM,CAAC,EAAQ,KAAsB,OAAO,QAAQ,EAAO,EAAK,EACnE,IAAK,IAAM,KAAS,EAAmB,CACrC,IAAM,EAAM,EAAmB,CAC7B,OAAQ,EAAO,SACf,SACA,WAAY,EAAM,UACpB,CAAC,EACD,EAAQ,IAAI,CAAG,EACf,EAAa,IACX,EACA,EAAM,UAAU,IAAI,GAClB,EAAmB,CACjB,OAAQ,EAAO,SACf,SACA,WAAY,CACd,CAAC,CACH,CACF,CACF,CAIJ,IAAM,EAAO,IAAI,IACX,EAAU,IAAI,IAEpB,GAAI,CAAC,EAAc,CACjB,IAAK,IAAM,KAAc,EAAa,CACpC,IAAM,EAAM,EAAmB,CAAU,EACrC,CAAC,EAAQ,IAAI,CAAG,GAAK,EAAK,IAAI,CAAG,IACrC,EAAK,IAAI,CAAG,EACZ,EAAQ,IAAI,EAAK,CAAU,EAC7B,CAIA,IAAI,EAAU,GACd,KAAO,GAAS,CACd,EAAU,GACV,IAAK,IAAM,KAAO,EAAQ,KAAK,GAChB,EAAa,IAAI,CAAG,GAAK,CAAC,EAAA,CAC9B,KAAK,GAAc,CAAC,EAAQ,IAAI,CAAU,CAAC,IAClD,EAAQ,OAAO,CAAG,EAClB,EAAU,GAGhB,CACF,CAEA,IAAM,EAAoC,CAAC,GAAG,EAAQ,OAAO,CAAC,EAExD,CAAC,GAAW,MAAM,EACrB,IAAI,IAAI,CAAC,CACT,OAAO,CAAK,CAAC,CACb,IAAI,CAAE,KAAM,CAAE,eAAc,YAAa,CAAU,CAAE,CAAC,CAAC,CACvD,MAAM,EAAG,EAAM,GAAI,CAAO,CAAC,CAAC,CAC5B,UAAU,CAAE,GAAI,EAAM,EAAG,CAAC,EAM7B,OAJK,EAIE,EAAE,KAAK,CAAE,eAAc,YAAa,CAAU,EAAG,GAAG,EAHlD,EAAE,KAAK,CAAE,MAAO,uBAAwB,EAAG,GAAG,CAIzD,CACF,CAAC"}