@voyant-travel/hono 0.118.2 → 0.118.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"require-actor.d.ts","sourceRoot":"","sources":["../../src/middleware/require-actor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAEhD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAG7C,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;
|
|
1
|
+
{"version":3,"file":"require-actor.d.ts","sourceRoot":"","sources":["../../src/middleware/require-actor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAEhD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAG7C,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AA8DlE;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAIzD;AAED,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAMD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,EAC5E,GAAG,OAAO,EAAE,KAAK,EAAE,GAClB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,SAAS,CAAA;IACnB,SAAS,EAAE,eAAe,CAAA;CAC3B,CAAC,CAAA;AACF,wBAAgB,YAAY,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,EAC5E,OAAO,EAAE,mBAAmB,EAC5B,GAAG,OAAO,EAAE,KAAK,EAAE,GAClB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,SAAS,CAAA;IACnB,SAAS,EAAE,eAAe,CAAA;CAC3B,CAAC,CAAA"}
|
|
@@ -10,7 +10,7 @@ function apiKeyResourceFromPath(pathname) {
|
|
|
10
10
|
}
|
|
11
11
|
return null;
|
|
12
12
|
}
|
|
13
|
-
function
|
|
13
|
+
function baseApiKeyPermissionActionsForMethod(method) {
|
|
14
14
|
switch (method.toUpperCase()) {
|
|
15
15
|
case "GET":
|
|
16
16
|
case "HEAD":
|
|
@@ -26,6 +26,27 @@ function apiKeyPermissionActionsForMethod(method) {
|
|
|
26
26
|
return [];
|
|
27
27
|
}
|
|
28
28
|
}
|
|
29
|
+
/**
|
|
30
|
+
* Search endpoints accept complex request bodies, so they're exposed as `POST`
|
|
31
|
+
* even though they're read-family operations. Without this, `POST
|
|
32
|
+
* /v1/<surface>/catalog/search` would only accept `write`/`trigger`/`relay`,
|
|
33
|
+
* and a `catalog:search`/`catalog:read`-scoped token would be rejected
|
|
34
|
+
* (voyant#2649). Matching a `search` / `*-search` path segment (e.g.
|
|
35
|
+
* `/catalog/search`, `/catalog/package-search`) keeps every other POST route
|
|
36
|
+
* (product writes, bookings, pricing, …) gated on its normal write actions.
|
|
37
|
+
*/
|
|
38
|
+
function isSearchPath(pathname) {
|
|
39
|
+
// A segment that is `search` or ends in `-search` (e.g. `package-search`),
|
|
40
|
+
// bounded so `/searchable` or `/researcher` don't count.
|
|
41
|
+
return /(?:\/|-)search(?:\/|$)/.test(pathname);
|
|
42
|
+
}
|
|
43
|
+
function apiKeyPermissionActionsForMethod(method, pathname) {
|
|
44
|
+
const actions = baseApiKeyPermissionActionsForMethod(method);
|
|
45
|
+
if (isSearchPath(pathname)) {
|
|
46
|
+
return Array.from(new Set([...actions, "search", "read"]));
|
|
47
|
+
}
|
|
48
|
+
return actions;
|
|
49
|
+
}
|
|
29
50
|
function hasAnyApiKeyPermission(scopes, resource, actions) {
|
|
30
51
|
if (!scopes || scopes.length === 0)
|
|
31
52
|
return false;
|
|
@@ -69,7 +90,7 @@ export function requireActor(...args) {
|
|
|
69
90
|
// is a reserved namespace (no module is named `_meta`).
|
|
70
91
|
if (resource === "_meta")
|
|
71
92
|
return next();
|
|
72
|
-
const actions = apiKeyPermissionActionsForMethod(c.req.method);
|
|
93
|
+
const actions = apiKeyPermissionActionsForMethod(c.req.method, pathname);
|
|
73
94
|
if (resource && hasAnyApiKeyPermission(c.get("scopes"), resource, actions)) {
|
|
74
95
|
return next();
|
|
75
96
|
}
|
|
@@ -99,7 +120,7 @@ export function requireActor(...args) {
|
|
|
99
120
|
});
|
|
100
121
|
const resource = apiKeyResourceFromPath(pathname);
|
|
101
122
|
if (resource && resource !== "_meta") {
|
|
102
|
-
const actions = apiKeyPermissionActionsForMethod(c.req.method);
|
|
123
|
+
const actions = apiKeyPermissionActionsForMethod(c.req.method, pathname);
|
|
103
124
|
if (!hasAnyApiKeyPermission(scopes, resource, actions)) {
|
|
104
125
|
return c.json({ error: "Forbidden: missing required permission" }, 403);
|
|
105
126
|
}
|