@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

package/dist/esm/requests/service/websocket.service.js

@@ -20,11 +20,11 @@ import { AppConfigurationService } from '../../config/services/app-configuration
 import { RedisService } from '../../databases/services/redis.service.js';
 import { ErrorBuilderBackendService } from '../../errors/services/error-builder.backend.service.js';
 import { runInFreshRequestContextIfAbsent } from '../../runtime/models/request-context.als.backend.js';
-import { ErrorCustomMessageReference, ErrorType, ExecutionContext_ExecutionType, ResourcePrimaryScope, CoreResourceOperation, CoreResourceType, ARRAY_RESPONSE_OPERATIONS, DataMode, ResourcesConfigOperationsDtosBuilderUtils, ResourcesConfig_OperationPathUtils, ResourceOperationsUtils, WildoHeaderKeys, ResourceOperationVariantType, isWildoBackendError, } from '@wildo-ai/saas-models';
+import { ErrorCustomMessageReference, ErrorType, ExecutionContext_ExecutionType, ResourcePrimaryScope, isSupportedNotificationBadgeScope, CoreResourceOperation, CoreResourceType, ARRAY_RESPONSE_OPERATIONS, DataMode, ResourcesConfigOperationsDtosBuilderUtils, ResourcesConfig_OperationPathUtils, ResourceOperationsUtils, WildoHeaderKeys, ResourceOperationVariantType, isWildoBackendError, } from '@wildo-ai/saas-models';
 import { ExecutionContextCreatorBackendService, } from '../../runtime/services/execution-context-creator.backend.service.js';
 import { AuthorizationsBackendService } from '../../security/authorizations/services/authorizations.backend.service.js';
 import { ResourcesRegistryBackendService } from '../../resources/services/resources-registry.backend.service.js';
-import { WS_ResourceSubscribePayloadSchema, WS_ResourceEditingPayloadSchema, WS_ResourceCustomEventPayloadSchema, NotificationDisplayTarget, ResourceAction, buildResourceRoomName, buildScopeRoomName, buildUserRoomName, buildOrganizationRoomName, buildOrganizationRoleRoomName, buildAppRoleRoomName, parseOrganizationRoomName, WebSocketRoomPrefix, CoreWebSocketEvent, CoreWebSocketConnectionErrorCode, WebSocketResourceDeliveryTarget, WS_FlowsActorsStartPayloadSchema, WS_FlowsActorsApprovalResponsePayloadSchema, } from '@wildo-ai/saas-models';
+import { WS_ResourceSubscribePayloadSchema, WS_ResourceEditingPayloadSchema, WS_ResourceCustomEventPayloadSchema, NotificationDisplayTarget, ResourceAction, buildResourceRoomName, buildScopeRoomName, ResourceScopeRoomKey, buildUserRoomName, buildOrganizationRoomName, buildOrganizationRoleRoomName, buildAppRoleRoomName, parseOrganizationRoomName, WebSocketRoomPrefix, CoreWebSocketEvent, CoreWebSocketConnectionErrorCode, WebSocketResourceDeliveryTarget, WS_FlowsActorsStartPayloadSchema, WS_FlowsActorsApprovalResponsePayloadSchema, } from '@wildo-ai/saas-models';
 import { logWildoBackendErrorAtClassifiedSeverity, projectCaughtErrorLogFields } from '../../errors/utils/error-log-level-classification.backend.utils.js';
 import { relaxAbuseThrottleMaxForEnvironment } from '../../errors/utils/rate-limit-environment-relaxation.backend.utils.js';
 function subscriptionMatchesOrganization(subscription, organizationId) {
@@ -201,7 +201,7 @@ let WebSocketService = class WebSocketService {
                     await this.verifyResourceAccess(socket, auth, subscription.resourceType, subscription.resourceId, subscription.contextResourceIdentifiers);
                 }
                 else if (subscription.scopeKey && subscription.scopeId) {
-                    await this.verifyScopeAccess(auth, subscription.scopeKey, subscription.scopeId, subscription.contextResourceIdentifiers);
+                    await this.verifyScopeAccess(auth, subscription.resourceType, subscription.scopeKey, subscription.scopeId, subscription.contextResourceIdentifiers);
                 }
                 else {
                     throw new Error('Tracked resource subscription is missing routing identifiers');
@@ -1056,7 +1056,7 @@ let WebSocketService = class WebSocketService {
     async getResourceEditingUsers(resourceType, resourceId) {
         const prefix = this.redisService.getAppPrefix();
         const key = `${prefix}editing:${resourceType}:${resourceId}`;
-        const redisClient = this.redisService.getClient();
+        const redisClient = this.redisService.getReadyClient();
         if (!redisClient) {
             return Array.from(this.resourceEditingState.get(key) || []);
         }
@@ -1559,7 +1559,7 @@ let WebSocketService = class WebSocketService {
                 }
                 else if (scopeKey && scopeId) {
                     // For collection subscription, verify context access
-                    await this.verifyScopeAccess(auth, scopeKey, scopeId, contextResourceIdentifiers);
+                    await this.verifyScopeAccess(auth, resourceType, scopeKey, scopeId, contextResourceIdentifiers);
                 }
                 else {
                     throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {
@@ -2154,8 +2154,20 @@ let WebSocketService = class WebSocketService {
                 return;
             try {
                 const auth = this.getSocketAuth(socket);
+                /**
+                 * `payload.scope` is CLIENT-supplied. It used to be cast (`as ResourcePrimaryScope`) and
+                 * handed straight to the access check and the badge service, so a scope no resource type
+                 * backs — `application`, dropped by the polymorphism refactor — reached both and was
+                 * answered with a silent zero. Parse it instead: an unsupported scope is refused here, and
+                 * what continues is a value the badge service's own two-scope contract can accept.
+                 */
+                if (!isSupportedNotificationBadgeScope(payload.scope)) {
+                    callback({ count: 0 });
+                    return;
+                }
+                const badgeScope = payload.scope;
                 // Verify user has access to this scope
-                if (!this.verifyBadgeScopeAccess(auth, payload.scope, payload.scopeId)) {
+                if (!this.verifyBadgeScopeAccess(auth, badgeScope, payload.scopeId)) {
                     callback({ count: 0 });
                     return;
                 }
@@ -2166,7 +2178,7 @@ let WebSocketService = class WebSocketService {
                     return;
                 }
                 const executionContext = await this.executionContextCreator.buildContextFromSocketAuth(auth, appReadOp, {});
-                const count = await this.getBadgeService().getBadgeCount(executionContext, payload.scope, payload.scopeId, payload.identifier);
+                const count = await this.getBadgeService().getBadgeCount(executionContext, badgeScope, payload.scopeId, payload.identifier);
                 callback({ count });
             }
             catch (error) {
@@ -2182,8 +2194,14 @@ let WebSocketService = class WebSocketService {
                 return;
             try {
                 const auth = this.getSocketAuth(socket);
+                // Same parse-don't-cast as `badge:get` above — see the comment there.
+                if (!isSupportedNotificationBadgeScope(payload.scope)) {
+                    callback([]);
+                    return;
+                }
+                const badgeScope = payload.scope;
                 // Verify user has access to this scope
-                if (!this.verifyBadgeScopeAccess(auth, payload.scope, payload.scopeId)) {
+                if (!this.verifyBadgeScopeAccess(auth, badgeScope, payload.scopeId)) {
                     callback([]);
                     return;
                 }
@@ -2194,7 +2212,7 @@ let WebSocketService = class WebSocketService {
                     return;
                 }
                 const executionContext = await this.executionContextCreator.buildContextFromSocketAuth(auth, appReadOp, {});
-                const badges = await this.getBadgeService().getAllBadges(executionContext, payload.scope, payload.scopeId);
+                const badges = await this.getBadgeService().getAllBadges(executionContext, badgeScope, payload.scopeId);
                 callback(badges);
             }
             catch (error) {
@@ -2208,6 +2226,15 @@ let WebSocketService = class WebSocketService {
     /**
      * Verify user has access to a badge scope
      */
+    /**
+     * May this socket read badges at `(scope, scopeId)`?
+     *
+     * Typed `NotificationScope` rather than `ResourcePrimaryScope` because only two scopes have a
+     * badge resource behind them. The removed third arm granted access to "application-level badges"
+     * on the strength of holding any application role — a survivor of the polymorphism refactor that
+     * dropped the APPLICATION variant, so it authorized reads of badges that cannot exist. Callers
+     * now refuse an unsupported scope before they get here.
+     */
     verifyBadgeScopeAccess(auth, scope, scopeId) {
         // Public users cannot access badges
         if (auth.executionType === ExecutionContext_ExecutionType.PUBLIC_EXECUTION) {
@@ -2221,9 +2248,6 @@ let WebSocketService = class WebSocketService {
                 // User must be member of the organization
                 return auth.initiatorRoles.some(r => r.relatedPrimaryScope === ResourcePrimaryScope.ORGANIZATIONS &&
                     r.relatedResourceId === scopeId);
-            case ResourcePrimaryScope.APPLICATION:
-                // Application-level badges - check if user has any app roles
-                return auth.initiatorRoles.some(r => r.relatedPrimaryScope === ResourcePrimaryScope.APPLICATION);
             default:
                 return false;
         }
@@ -2265,7 +2289,14 @@ let WebSocketService = class WebSocketService {
      *
      * REUSES: Role-based check for organization scope, or AuthorizationsBackendService for parent resources
      */
-    async verifyScopeAccess(auth, scopeKey, scopeId, contextResourceIdentifiers) {
+    async verifyScopeAccess(auth, 
+    /**
+     * The resource whose collection is being subscribed to.
+     *
+     * Needed because APPLICATION scope authorizes THIS resource rather than the scope — see the
+     * branch below. The other scopes do not read it, and that asymmetry is the point.
+     */
+    resourceType, scopeKey, scopeId, contextResourceIdentifiers) {
         if (auth.executionType === ExecutionContext_ExecutionType.PUBLIC_EXECUTION) {
             throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {
                 customMessageReference: ErrorCustomMessageReference.AUTHORIZATIONS_ACCESS_DENIED,
@@ -2285,6 +2316,48 @@ let WebSocketService = class WebSocketService {
             }
             return;
         }
+        /*
+         * APPLICATION scope authorizes the SUBSCRIBED resource, never the scope (issue #247).
+         *
+         * `applicationId` is a single constant per backend, so an `app` room discriminates NOTHING —
+         * every authenticated caller is "in" it. That is precisely why it cannot be used as an
+         * authorization proxy the way the two scopes above are: `org` is checked against the caller's own
+         * role entries for that tenant, and a parent scope authorizes a specific parent row. Both stand
+         * for "may you see things under here"; a constant stands for nothing.
+         *
+         * The tempting fix is to let this fall through to the parent branch below, since
+         * `PRIMARY_SCOPE_TO_CORE_RESOURCE_TYPE` already maps APPLICATION to the `applications` resource
+         * and `mapScopeKeyToResourceType` only misses it because it searches for the field identifier
+         * `appId` while the real one is `applicationId`. It looks like completing an oversight. It is a
+         * disclosure: READ on the `applications` row is granted to ORG_MEMBER ("Org members can view
+         * applications"), while TEN of the eleven APPLICATION-scoped resource configs require
+         * APP_ADMIN_SUPER_ADMIN — SSO connections and config, SIEM export config and DLQ, SCIM
+         * provisioning, webhook config, M2M delivery logs, flows/actors task and execution. Routing
+         * through the parent would hand every org member notification streams naming rows of all of them.
+         *
+         * So the rule this branch enforces, and which the two above satisfy only incidentally: **a scope
+         * room may never grant more than a READ of what it notifies about.** Here that is asked directly,
+         * on ROLES alone, because a scope subscription addresses no row.
+         *
+         * The PUBLIC guard at the top of this method is defence in depth rather than the primary gate: a
+         * public socket joins only the public room and returns before `setupResourceRoomHandlers` ever
+         * registers, so it has no `resource:subscribe` listener at all. This method is still reachable for
+         * a public principal through the tracked-subscription REPLAY on auth refresh, which is why the
+         * guard stays.
+         */
+        if (normalizedScopeKey === ResourceScopeRoomKey.APPLICATION) {
+            const readOperation = this.resolveSocketAuthorizationDefaultOperation(resourceType, CoreResourceOperation.READ);
+            if (!readOperation) {
+                throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {
+                    customMessageReference: ErrorCustomMessageReference.RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND,
+                    context: { resourceType, scopeKey, operation: CoreResourceOperation.READ },
+                });
+            }
+            const applicationScopeContext = await this.executionContextCreator.buildContextFromSocketAuth(auth, readOperation, contextResourceIdentifiers);
+            await this.authorizationsService.authorizeOperationRolesOnly(readOperation, applicationScopeContext);
+            this.logDebug('Socket application-scope authorization succeeded', { resourceType, scopeId });
+            return;
+        }
         // For other scopes (e.g., todolist), verify READ access to the parent resource
         const parentResourceType = this.mapScopeKeyToResourceType(scopeKey);
         if (!parentResourceType) {
@@ -2493,7 +2566,7 @@ let WebSocketService = class WebSocketService {
     async trackEditingState(resourceType, resourceId, userId, action) {
         const prefix = this.redisService.getAppPrefix();
         const key = `${prefix}editing:${resourceType}:${resourceId}`;
-        const redisClient = this.redisService.getClient();
+        const redisClient = this.redisService.getReadyClient();
         if (!redisClient) {
             // Fallback to in-memory if Redis unavailable
             if (action === 'start') {
@@ -2534,7 +2607,7 @@ let WebSocketService = class WebSocketService {
     async cleanupEditingStatesForUser(userId) {
         if (!userId)
             return;
-        const redisClient = this.redisService.getClient();
+        const redisClient = this.redisService.getReadyClient();
         // Cleanup in-memory state on this pod
         for (const [key, users] of this.resourceEditingState.entries()) {
             if (users.has(userId)) {