@xemahq/authorization-nest 0.1.0 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/authzen.transport.d.ts +2 -2
- package/dist/authzen.transport.d.ts.map +1 -1
- package/dist/authzen.transport.js +1 -1
- package/dist/authzen.transport.js.map +1 -1
- package/dist/index.d.ts +2 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +2 -0
- package/dist/index.js.map +1 -1
- package/dist/internal-caller-or-member-context.guard.d.ts +19 -0
- package/dist/internal-caller-or-member-context.guard.d.ts.map +1 -0
- package/dist/internal-caller-or-member-context.guard.js +107 -0
- package/dist/internal-caller-or-member-context.guard.js.map +1 -0
- package/dist/organization-delegation-admission.d.ts +10 -0
- package/dist/organization-delegation-admission.d.ts.map +1 -0
- package/dist/organization-delegation-admission.js +47 -0
- package/dist/organization-delegation-admission.js.map +1 -0
- package/dist/subject-from-context.d.ts +1 -0
- package/dist/subject-from-context.d.ts.map +1 -1
- package/dist/subject-from-context.js +5 -6
- package/dist/subject-from-context.js.map +1 -1
- package/dist/xema-authz.service.d.ts +4 -2
- package/dist/xema-authz.service.d.ts.map +1 -1
- package/dist/xema-authz.service.js +33 -0
- package/dist/xema-authz.service.js.map +1 -1
- package/package.json +5 -5
|
@@ -3,7 +3,7 @@ import { type ServiceRegistry } from '@xemahq/contracts/service-registry';
|
|
|
3
3
|
import { IdentityBootstrapService } from '@xemahq/identity-client';
|
|
4
4
|
import { type XemaAuthorizationOptions } from './authorization.options';
|
|
5
5
|
export interface AuthzenPdpTransport {
|
|
6
|
-
evaluation(orgId: string, request: AccessEvaluationRequest): Promise<AccessEvaluationResponse>;
|
|
6
|
+
evaluation(orgId: string | null, request: AccessEvaluationRequest): Promise<AccessEvaluationResponse>;
|
|
7
7
|
evaluations(orgId: string, request: AccessEvaluationsRequest): Promise<AccessEvaluationsResponse>;
|
|
8
8
|
searchResource(orgId: string, request: ResourceSearchRequest): Promise<ResourceSearchResponse>;
|
|
9
9
|
searchSubject(orgId: string, request: SubjectSearchRequest): Promise<SubjectSearchResponse>;
|
|
@@ -20,7 +20,7 @@ export declare class HttpAuthzenPdpTransport implements AuthzenPdpTransport {
|
|
|
20
20
|
private readonly identityBootstrap;
|
|
21
21
|
private readonly options;
|
|
22
22
|
constructor(registry: ServiceRegistry, identityBootstrap: IdentityBootstrapService, options: XemaAuthorizationOptions);
|
|
23
|
-
evaluation(orgId: string, request: AccessEvaluationRequest): Promise<AccessEvaluationResponse>;
|
|
23
|
+
evaluation(orgId: string | null, request: AccessEvaluationRequest): Promise<AccessEvaluationResponse>;
|
|
24
24
|
evaluations(orgId: string, request: AccessEvaluationsRequest): Promise<AccessEvaluationsResponse>;
|
|
25
25
|
searchResource(orgId: string, request: ResourceSearchRequest): Promise<ResourceSearchResponse>;
|
|
26
26
|
searchSubject(orgId: string, request: SubjectSearchRequest): Promise<SubjectSearchResponse>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authzen.transport.d.ts","sourceRoot":"","sources":["../src/authzen.transport.ts"],"names":[],"mappings":"AACA,OAAO,EAOL,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAMnE,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AAajC,MAAM,WAAW,mBAAmB;IAClC,UAAU,CACR,KAAK,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"authzen.transport.d.ts","sourceRoot":"","sources":["../src/authzen.transport.ts"],"names":[],"mappings":"AACA,OAAO,EAOL,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAMnE,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AAajC,MAAM,WAAW,mBAAmB;IAClC,UAAU,CACR,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACrC,WAAW,CACT,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtC,cAAc,CACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnC,aAAa,CACX,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAClC,YAAY,CACV,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClC;AAED,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAGrE,qBAAa,eAAgB,SAAQ,KAAK;aAGtB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM,GAAG,SAAS;gBAFxC,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,SAAS;CAK3C;AAED,qBACa,uBAAwB,YAAW,mBAAmB;IAG/D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAHP,QAAQ,EAAE,eAAe,EACzB,iBAAiB,EAAE,wBAAwB,EAE3C,OAAO,EAAE,wBAAwB;IAG7C,UAAU,CACf,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,wBAAwB,CAAC;IAS7B,WAAW,CAChB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,yBAAyB,CAAC;IAS9B,cAAc,CACnB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,sBAAsB,CAAC;IAS3B,aAAa,CAClB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;IAS1B,YAAY,CACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,oBAAoB,CAAC;YASlB,IAAI;CA2CnB"}
|
|
@@ -63,7 +63,7 @@ let HttpAuthzenPdpTransport = class HttpAuthzenPdpTransport {
|
|
|
63
63
|
headers: {
|
|
64
64
|
Authorization: `Bearer ${token}`,
|
|
65
65
|
'Content-Type': 'application/json',
|
|
66
|
-
'X-Xema-Org-Id': orgId,
|
|
66
|
+
...(orgId === null ? {} : { 'X-Xema-Org-Id': orgId }),
|
|
67
67
|
},
|
|
68
68
|
body: JSON.stringify(body),
|
|
69
69
|
signal: AbortSignal.timeout(this.options.requestTimeoutMs),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authzen.transport.js","sourceRoot":"","sources":["../src/authzen.transport.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,uDAiBmC;AACnC,yEAG4C;AAC5C,6DAAmE;AACnE,yEAGuC;AAEvC,mEAGiC;AAoCpB,QAAA,qBAAqB,GAAG,MAAM,CAAC,uBAAuB,CAAC,CAAC;AAGrE,MAAa,eAAgB,SAAQ,KAAK;IAGtB;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,IAAwB;QAExC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAoB;QAGxC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC;IACnC,CAAC;CACF;AATD,0CASC;AAGM,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAGf;IACA;IAEA;IALnB,YAEmB,QAAyB,EACzB,iBAA2C,EAE3C,OAAiC;QAHjC,aAAQ,GAAR,QAAQ,CAAiB;QACzB,sBAAiB,GAAjB,iBAAiB,CAA0B;QAE3C,YAAO,GAAP,OAAO,CAA0B;IACjD,CAAC;IAEG,UAAU,CACf,
|
|
1
|
+
{"version":3,"file":"authzen.transport.js","sourceRoot":"","sources":["../src/authzen.transport.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,uDAiBmC;AACnC,yEAG4C;AAC5C,6DAAmE;AACnE,yEAGuC;AAEvC,mEAGiC;AAoCpB,QAAA,qBAAqB,GAAG,MAAM,CAAC,uBAAuB,CAAC,CAAC;AAGrE,MAAa,eAAgB,SAAQ,KAAK;IAGtB;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,IAAwB;QAExC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAoB;QAGxC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC;IACnC,CAAC;CACF;AATD,0CASC;AAGM,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAGf;IACA;IAEA;IALnB,YAEmB,QAAyB,EACzB,iBAA2C,EAE3C,OAAiC;QAHjC,aAAQ,GAAR,QAAQ,CAAiB;QACzB,sBAAiB,GAAjB,iBAAiB,CAA0B;QAE3C,YAAO,GAAP,OAAO,CAA0B;IACjD,CAAC;IAEG,UAAU,CACf,KAAoB,EACpB,OAAgC;QAEhC,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,UAAU,EAC9B,OAAO,EACP,wCAA8B,CAC/B,CAAC;IACJ,CAAC;IAEM,WAAW,CAChB,KAAa,EACb,OAAiC;QAEjC,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,WAAW,EAC/B,OAAO,EACP,yCAA+B,CAChC,CAAC;IACJ,CAAC;IAEM,cAAc,CACnB,KAAa,EACb,OAA8B;QAE9B,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,cAAc,EAClC,OAAO,EACP,sCAA4B,CAC7B,CAAC;IACJ,CAAC;IAEM,aAAa,CAClB,KAAa,EACb,OAA6B;QAE7B,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,aAAa,EACjC,OAAO,EACP,qCAA2B,CAC5B,CAAC;IACJ,CAAC;IAEM,YAAY,CACjB,KAAa,EACb,OAA4B;QAE5B,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,YAAY,EAChC,OAAO,EACP,oCAA0B,CAC3B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,KAAoB,EACpB,IAAyB,EACzB,IAAY,EACZ,MAAS;QAET,MAAM,OAAO,GAAG,MAAM,IAAA,sCAAc,EAClC,IAAI,CAAC,QAAQ,EACb,8BAAW,CAAC,iBAAiB,CAC9B,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,kBAAkB;gBAElC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;aACtD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC3D,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,eAAe,CACvB,0BAA0B,IAAI,qBAAqB,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAC5F,QAAQ,CAAC,MAAM,EACf,SAAS,CAAC,MAAM,CAAC,CAClB,CAAC;QACJ,CAAC;QAGD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CACvB,0BAA0B,IAAI,mDAAmD,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EACvG,GAAG,EACH,SAAS,CACV,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;CACF,CAAA;AAhHY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,8CAAsB,CAAC,CAAA;IAG9B,WAAA,IAAA,eAAM,EAAC,kDAA0B,CAAC,CAAA;6CADC,0CAAwB;GAJnD,uBAAuB,CAgHnC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAa;IAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QACzB,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -6,4 +6,6 @@ export * from './authzen.transport';
|
|
|
6
6
|
export * from './subject-from-context';
|
|
7
7
|
export * from './xema-authz.service';
|
|
8
8
|
export * from './policy-decisions';
|
|
9
|
+
export * from './internal-caller-or-member-context.guard';
|
|
10
|
+
export * from './organization-delegation-admission';
|
|
9
11
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,2CAA2C,CAAC;AAC1D,cAAc,qCAAqC,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -22,4 +22,6 @@ __exportStar(require("./authzen.transport"), exports);
|
|
|
22
22
|
__exportStar(require("./subject-from-context"), exports);
|
|
23
23
|
__exportStar(require("./xema-authz.service"), exports);
|
|
24
24
|
__exportStar(require("./policy-decisions"), exports);
|
|
25
|
+
__exportStar(require("./internal-caller-or-member-context.guard"), exports);
|
|
26
|
+
__exportStar(require("./organization-delegation-admission"), exports);
|
|
25
27
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,yDAAuC;AACvC,0DAAwC;AACxC,wDAAsC;AACtC,sDAAoC;AACpC,yDAAuC;AACvC,uDAAqC;AACrC,qDAAmC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,yDAAuC;AACvC,0DAAwC;AACxC,wDAAsC;AACtC,sDAAoC;AACpC,yDAAuC;AACvC,uDAAqC;AACrC,qDAAmC;AACnC,4EAA0D;AAC1D,sEAAoD"}
|
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
import { type CanActivate, type ExecutionContext } from '@nestjs/common';
|
|
2
|
+
import { type AuthModuleOptions } from '@xemahq/platform-common';
|
|
3
|
+
export declare enum MemberContextRefusalCode {
|
|
4
|
+
NotAMemberContext = "MEMBER_CONTEXT_REQUIRED",
|
|
5
|
+
NotBoundaryIssued = "MEMBER_CONTEXT_NOT_BOUNDARY_ISSUED",
|
|
6
|
+
OrgNotProven = "MEMBER_CONTEXT_ORG_NOT_PROVEN",
|
|
7
|
+
NotAMember = "MEMBER_CONTEXT_NOT_A_MEMBER"
|
|
8
|
+
}
|
|
9
|
+
export declare class InternalCallerOrMemberContextGuard implements CanActivate {
|
|
10
|
+
private readonly authOptions?;
|
|
11
|
+
private readonly logger;
|
|
12
|
+
private readonly internalCaller;
|
|
13
|
+
private readonly reflector;
|
|
14
|
+
constructor(authOptions?: AuthModuleOptions | undefined);
|
|
15
|
+
canActivate(context: ExecutionContext): Promise<boolean>;
|
|
16
|
+
private boundaryIssuers;
|
|
17
|
+
private refuse;
|
|
18
|
+
}
|
|
19
|
+
//# sourceMappingURL=internal-caller-or-member-context.guard.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"internal-caller-or-member-context.guard.d.ts","sourceRoot":"","sources":["../src/internal-caller-or-member-context.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACtB,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAEL,KAAK,iBAAiB,EAMvB,MAAM,yBAAyB,CAAC;AASjC,oBAAY,wBAAwB;IAElC,iBAAiB,4BAA4B;IAE7C,iBAAiB,uCAAuC;IAExD,YAAY,kCAAkC;IAE9C,UAAU,gCAAgC;CAC3C;AA2CD,qBACa,kCAAmC,YAAW,WAAW;IAQlE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAP/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuD;IAC9E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA6B;IAC5D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;gBAK1B,WAAW,CAAC,EAAE,iBAAiB,YAAA;IAG5C,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;YAmDhD,eAAe;IAY7B,OAAO,CAAC,MAAM;CAQf"}
|
|
@@ -0,0 +1,107 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
|
|
3
|
+
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
|
|
4
|
+
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
|
|
5
|
+
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
|
|
6
|
+
return c > 3 && r && Object.defineProperty(target, key, r), r;
|
|
7
|
+
};
|
|
8
|
+
var __metadata = (this && this.__metadata) || function (k, v) {
|
|
9
|
+
if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
|
|
10
|
+
};
|
|
11
|
+
var __param = (this && this.__param) || function (paramIndex, decorator) {
|
|
12
|
+
return function (target, key) { decorator(target, key, paramIndex); }
|
|
13
|
+
};
|
|
14
|
+
var InternalCallerOrMemberContextGuard_1;
|
|
15
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
16
|
+
exports.InternalCallerOrMemberContextGuard = exports.MemberContextRefusalCode = void 0;
|
|
17
|
+
const common_1 = require("@nestjs/common");
|
|
18
|
+
const core_1 = require("@nestjs/core");
|
|
19
|
+
const subject_1 = require("@xemahq/contracts/subject");
|
|
20
|
+
const principal_context_claims_1 = require("@xemahq/identity-client/principal-context-claims");
|
|
21
|
+
const platform_common_1 = require("@xemahq/platform-common");
|
|
22
|
+
const organization_delegation_admission_1 = require("./organization-delegation-admission");
|
|
23
|
+
var MemberContextRefusalCode;
|
|
24
|
+
(function (MemberContextRefusalCode) {
|
|
25
|
+
MemberContextRefusalCode["NotAMemberContext"] = "MEMBER_CONTEXT_REQUIRED";
|
|
26
|
+
MemberContextRefusalCode["NotBoundaryIssued"] = "MEMBER_CONTEXT_NOT_BOUNDARY_ISSUED";
|
|
27
|
+
MemberContextRefusalCode["OrgNotProven"] = "MEMBER_CONTEXT_ORG_NOT_PROVEN";
|
|
28
|
+
MemberContextRefusalCode["NotAMember"] = "MEMBER_CONTEXT_NOT_A_MEMBER";
|
|
29
|
+
})(MemberContextRefusalCode || (exports.MemberContextRefusalCode = MemberContextRefusalCode = {}));
|
|
30
|
+
function claimsOf(token) {
|
|
31
|
+
const payload = token?.split('.')[1];
|
|
32
|
+
if (payload === undefined) {
|
|
33
|
+
return undefined;
|
|
34
|
+
}
|
|
35
|
+
try {
|
|
36
|
+
const claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
|
|
37
|
+
return typeof claims === 'object' && claims !== null
|
|
38
|
+
? claims
|
|
39
|
+
: undefined;
|
|
40
|
+
}
|
|
41
|
+
catch {
|
|
42
|
+
return undefined;
|
|
43
|
+
}
|
|
44
|
+
}
|
|
45
|
+
let InternalCallerOrMemberContextGuard = InternalCallerOrMemberContextGuard_1 = class InternalCallerOrMemberContextGuard {
|
|
46
|
+
authOptions;
|
|
47
|
+
logger = new common_1.Logger(InternalCallerOrMemberContextGuard_1.name);
|
|
48
|
+
internalCaller = new platform_common_1.InternalCallerGuard();
|
|
49
|
+
reflector = new core_1.Reflector();
|
|
50
|
+
constructor(authOptions) {
|
|
51
|
+
this.authOptions = authOptions;
|
|
52
|
+
}
|
|
53
|
+
async canActivate(context) {
|
|
54
|
+
const request = context.switchToHttp().getRequest();
|
|
55
|
+
const ctx = request[platform_common_1.REQUEST_CONTEXT];
|
|
56
|
+
if (ctx !== undefined && ctx.subject.kind === subject_1.SubjectKind.Organization) {
|
|
57
|
+
(0, organization_delegation_admission_1.assertOrganizationDelegationAdmitted)(ctx, this.reflector.getAllAndOverride(organization_delegation_admission_1.ACCEPT_ORGANIZATION_DELEGATION_FOR, [
|
|
58
|
+
context.getHandler(),
|
|
59
|
+
context.getClass(),
|
|
60
|
+
]));
|
|
61
|
+
return true;
|
|
62
|
+
}
|
|
63
|
+
if (ctx === undefined ||
|
|
64
|
+
ctx.tokenClass === subject_1.TokenClass.ServiceJwt ||
|
|
65
|
+
ctx.actorChain.length > 0) {
|
|
66
|
+
return this.internalCaller.canActivate(context);
|
|
67
|
+
}
|
|
68
|
+
if (ctx.tokenClass !== subject_1.TokenClass.UserJwt || ctx.subject.kind !== subject_1.SubjectKind.User) {
|
|
69
|
+
throw this.refuse(MemberContextRefusalCode.NotAMemberContext, ctx, 'This route admits a platform service, a delegated context, or a member\'s own context.');
|
|
70
|
+
}
|
|
71
|
+
const claims = claimsOf(ctx.bearerToken);
|
|
72
|
+
if (claims === undefined ||
|
|
73
|
+
claims[platform_common_1.CONTEXT_VERSION_CLAIM] !== principal_context_claims_1.CONTEXT_VERSION ||
|
|
74
|
+
claims['subject_kind'] !== principal_context_claims_1.ContextSubjectKind.User ||
|
|
75
|
+
typeof claims['iss'] !== 'string' ||
|
|
76
|
+
!(await this.boundaryIssuers()).has(claims['iss'])) {
|
|
77
|
+
throw this.refuse(MemberContextRefusalCode.NotBoundaryIssued, ctx, 'A member\'s own context must be a principal context issued by the identity boundary.');
|
|
78
|
+
}
|
|
79
|
+
if (ctx.orgAuthority?.source !== platform_common_1.OrgAuthoritySource.OrgClaim) {
|
|
80
|
+
throw this.refuse(MemberContextRefusalCode.OrgNotProven, ctx, 'The organization must be the context\'s own tenant claim, not a header alone.');
|
|
81
|
+
}
|
|
82
|
+
if (ctx.orgRole === undefined) {
|
|
83
|
+
throw this.refuse(MemberContextRefusalCode.NotAMember, ctx, 'The context grants no role in the organization it names.');
|
|
84
|
+
}
|
|
85
|
+
return true;
|
|
86
|
+
}
|
|
87
|
+
async boundaryIssuers() {
|
|
88
|
+
const configured = this.authOptions?.trustedIssuersProvider !== undefined
|
|
89
|
+
? await this.authOptions.trustedIssuersProvider()
|
|
90
|
+
: (this.authOptions?.trustedIssuers ?? []);
|
|
91
|
+
return new Set(configured
|
|
92
|
+
.filter((entry) => entry.claimAuthority === true)
|
|
93
|
+
.map((entry) => entry.issuer));
|
|
94
|
+
}
|
|
95
|
+
refuse(code, ctx, message) {
|
|
96
|
+
this.logger.warn({ message: code, actorId: ctx.actorId, orgId: ctx.orgId });
|
|
97
|
+
return new common_1.ForbiddenException({ code, message });
|
|
98
|
+
}
|
|
99
|
+
};
|
|
100
|
+
exports.InternalCallerOrMemberContextGuard = InternalCallerOrMemberContextGuard;
|
|
101
|
+
exports.InternalCallerOrMemberContextGuard = InternalCallerOrMemberContextGuard = InternalCallerOrMemberContextGuard_1 = __decorate([
|
|
102
|
+
(0, common_1.Injectable)(),
|
|
103
|
+
__param(0, (0, common_1.Optional)()),
|
|
104
|
+
__param(0, (0, common_1.Inject)(platform_common_1.AUTH_MODULE_OPTIONS)),
|
|
105
|
+
__metadata("design:paramtypes", [Object])
|
|
106
|
+
], InternalCallerOrMemberContextGuard);
|
|
107
|
+
//# sourceMappingURL=internal-caller-or-member-context.guard.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"internal-caller-or-member-context.guard.js","sourceRoot":"","sources":["../src/internal-caller-or-member-context.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAQwB;AACxB,uCAAyC;AACzC,uDAAoE;AACpE,+FAAuG;AACvG,6DAQiC;AAEjC,2FAG6C;AAI7C,IAAY,wBASX;AATD,WAAY,wBAAwB;IAElC,yEAA6C,CAAA;IAE7C,oFAAwD,CAAA;IAExD,0EAA8C,CAAA;IAE9C,sEAA0C,CAAA;AAC5C,CAAC,EATW,wBAAwB,wCAAxB,wBAAwB,QASnC;AAED,SAAS,QAAQ,CAAC,KAAyB;IACzC,MAAM,OAAO,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAAA,OAAO,SAAS,CAAC;IAAA,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACvF,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AA+BM,IAAM,kCAAkC,0CAAxC,MAAM,kCAAkC;IAQ1B;IAPF,MAAM,GAAG,IAAI,eAAM,CAAC,oCAAkC,CAAC,IAAI,CAAC,CAAC;IAC7D,cAAc,GAAG,IAAI,qCAAmB,EAAE,CAAC;IAC3C,SAAS,GAAG,IAAI,gBAAS,EAAE,CAAC;IAE7C,YAGmB,WAA+B;QAA/B,gBAAW,GAAX,WAAW,CAAoB;IAC/C,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAA2B,CAAC;QAC7E,MAAM,GAAG,GAAG,OAAO,CAAC,iCAAe,CAA+B,CAAC;QACnE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,qBAAW,CAAC,YAAY,EAAE,CAAC;YAIvE,IAAA,wEAAoC,EAClC,GAAG,EACH,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAqB,sEAAkC,EAAE;gBACvF,OAAO,CAAC,UAAU,EAAE;gBACpB,OAAO,CAAC,QAAQ,EAAE;aACnB,CAAC,CACH,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IACE,GAAG,KAAK,SAAS;YACjB,GAAG,CAAC,UAAU,KAAK,oBAAU,CAAC,UAAU;YACxC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EACzB,CAAC;YAED,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,KAAK,oBAAU,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,qBAAW,CAAC,IAAI,EAAE,CAAC;YACnF,MAAM,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,iBAAiB,EAAE,GAAG,EAC/D,wFAAwF,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzC,IACE,MAAM,KAAK,SAAS;YACpB,MAAM,CAAC,uCAAqB,CAAC,KAAK,0CAAe;YACjD,MAAM,CAAC,cAAc,CAAC,KAAK,6CAAkB,CAAC,IAAI;YAClD,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ;YACjC,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAClD,CAAC;YACD,MAAM,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,iBAAiB,EAAE,GAAG,EAC/D,sFAAsF,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM,KAAK,oCAAkB,CAAC,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,YAAY,EAAE,GAAG,EAC1D,+EAA+E,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,UAAU,EAAE,GAAG,EACxD,0DAA0D,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAGO,KAAK,CAAC,eAAe;QAC3B,MAAM,UAAU,GACd,IAAI,CAAC,WAAW,EAAE,sBAAsB,KAAK,SAAS;YACpD,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,EAAE;YACjD,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC;QAC/C,OAAO,IAAI,GAAG,CACZ,UAAU;aACP,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC;aAChD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAChC,CAAC;IACJ,CAAC;IAEO,MAAM,CACZ,IAA8B,EAC9B,GAAmB,EACnB,OAAe;QAEf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5E,OAAO,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AAlFY,gFAAkC;6CAAlC,kCAAkC;IAD9C,IAAA,mBAAU,GAAE;IAOR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,qCAAmB,CAAC,CAAA;;GAPnB,kCAAkC,CAkF9C"}
|
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
import { type RequestContext } from '@xemahq/platform-common';
|
|
2
|
+
export declare const ACCEPT_ORGANIZATION_DELEGATION_FOR = "xema:accept-organization-delegation-for";
|
|
3
|
+
export declare enum OrganizationDelegationRefusalCode {
|
|
4
|
+
NotAccepted = "ORGANIZATION_DELEGATION_NOT_ACCEPTED",
|
|
5
|
+
NotOwnOrganization = "ORGANIZATION_DELEGATION_NOT_OWN_ORGANIZATION",
|
|
6
|
+
OperationNotLent = "ORGANIZATION_DELEGATION_OPERATION_NOT_LENT"
|
|
7
|
+
}
|
|
8
|
+
export declare function AcceptOrganizationDelegationFor(capability: string): MethodDecorator & ClassDecorator;
|
|
9
|
+
export declare function assertOrganizationDelegationAdmitted(ctx: RequestContext, operation: string | undefined): void;
|
|
10
|
+
//# sourceMappingURL=organization-delegation-admission.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"organization-delegation-admission.d.ts","sourceRoot":"","sources":["../src/organization-delegation-admission.ts"],"names":[],"mappings":"AAMA,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGpF,eAAO,MAAM,kCAAkC,4CAA4C,CAAC;AAG5F,oBAAY,iCAAiC;IAE3C,WAAW,yCAAyC;IAEpD,kBAAkB,iDAAiD;IAEnE,gBAAgB,+CAA+C;CAChE;AAOD,wBAAgB,+BAA+B,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,GAAG,cAAc,CAKpG;AAiBD,wBAAgB,oCAAoC,CAClD,GAAG,EAAE,cAAc,EACnB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,IAAI,CAgCN"}
|
|
@@ -0,0 +1,47 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.OrganizationDelegationRefusalCode = exports.ACCEPT_ORGANIZATION_DELEGATION_FOR = void 0;
|
|
4
|
+
exports.AcceptOrganizationDelegationFor = AcceptOrganizationDelegationFor;
|
|
5
|
+
exports.assertOrganizationDelegationAdmitted = assertOrganizationDelegationAdmitted;
|
|
6
|
+
const common_1 = require("@nestjs/common");
|
|
7
|
+
const subject_1 = require("@xemahq/contracts/subject");
|
|
8
|
+
const platform_common_1 = require("@xemahq/platform-common");
|
|
9
|
+
exports.ACCEPT_ORGANIZATION_DELEGATION_FOR = 'xema:accept-organization-delegation-for';
|
|
10
|
+
var OrganizationDelegationRefusalCode;
|
|
11
|
+
(function (OrganizationDelegationRefusalCode) {
|
|
12
|
+
OrganizationDelegationRefusalCode["NotAccepted"] = "ORGANIZATION_DELEGATION_NOT_ACCEPTED";
|
|
13
|
+
OrganizationDelegationRefusalCode["NotOwnOrganization"] = "ORGANIZATION_DELEGATION_NOT_OWN_ORGANIZATION";
|
|
14
|
+
OrganizationDelegationRefusalCode["OperationNotLent"] = "ORGANIZATION_DELEGATION_OPERATION_NOT_LENT";
|
|
15
|
+
})(OrganizationDelegationRefusalCode || (exports.OrganizationDelegationRefusalCode = OrganizationDelegationRefusalCode = {}));
|
|
16
|
+
function AcceptOrganizationDelegationFor(capability) {
|
|
17
|
+
if (capability.trim() === '') {
|
|
18
|
+
throw new Error('@AcceptOrganizationDelegationFor() needs a capability ref.');
|
|
19
|
+
}
|
|
20
|
+
return (0, common_1.SetMetadata)(exports.ACCEPT_ORGANIZATION_DELEGATION_FOR, capability);
|
|
21
|
+
}
|
|
22
|
+
function assertOrganizationDelegationAdmitted(ctx, operation) {
|
|
23
|
+
if (operation === undefined) {
|
|
24
|
+
throw refusal(OrganizationDelegationRefusalCode.NotAccepted, 'This route admits no organization-delegated caller.');
|
|
25
|
+
}
|
|
26
|
+
const orgId = ctx.orgId.trim();
|
|
27
|
+
if (ctx.subject.kind !== subject_1.SubjectKind.Organization ||
|
|
28
|
+
ctx.delegation === undefined ||
|
|
29
|
+
orgId.length === 0 ||
|
|
30
|
+
ctx.subject.id !== orgId ||
|
|
31
|
+
ctx.orgAuthority === undefined ||
|
|
32
|
+
!(0, platform_common_1.isOrgAuthorityProven)(ctx.orgAuthority)) {
|
|
33
|
+
throw refusal(OrganizationDelegationRefusalCode.NotOwnOrganization, 'An organization is admitted only under its own verified delegation, for the organization the request names.');
|
|
34
|
+
}
|
|
35
|
+
const verdict = (0, subject_1.evaluateDelegatedAuthority)({
|
|
36
|
+
subjectKind: ctx.subject.kind,
|
|
37
|
+
delegation: ctx.delegation,
|
|
38
|
+
capability: operation,
|
|
39
|
+
});
|
|
40
|
+
if (verdict !== subject_1.DelegatedAuthorityVerdict.Admitted) {
|
|
41
|
+
throw refusal(OrganizationDelegationRefusalCode.OperationNotLent, `The organization's delegation does not lend ${operation}.`);
|
|
42
|
+
}
|
|
43
|
+
}
|
|
44
|
+
function refusal(code, message) {
|
|
45
|
+
return new common_1.ForbiddenException({ code, message });
|
|
46
|
+
}
|
|
47
|
+
//# sourceMappingURL=organization-delegation-admission.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"organization-delegation-admission.js","sourceRoot":"","sources":["../src/organization-delegation-admission.ts"],"names":[],"mappings":";;;AA0BA,0EAKC;AAiBD,oFAmCC;AAnFD,2CAAiE;AACjE,uDAImC;AACnC,6DAAoF;AAGvE,QAAA,kCAAkC,GAAG,yCAAyC,CAAC;AAG5F,IAAY,iCAOX;AAPD,WAAY,iCAAiC;IAE3C,yFAAoD,CAAA;IAEpD,wGAAmE,CAAA;IAEnE,oGAA+D,CAAA;AACjE,CAAC,EAPW,iCAAiC,iDAAjC,iCAAiC,QAO5C;AAOD,SAAgB,+BAA+B,CAAC,UAAkB;IAChE,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,IAAA,oBAAW,EAAC,0CAAkC,EAAE,UAAU,CAAC,CAAC;AACrE,CAAC;AAiBD,SAAgB,oCAAoC,CAClD,GAAmB,EACnB,SAA6B;IAE7B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,OAAO,CACX,iCAAiC,CAAC,WAAW,EAC7C,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC/B,IACE,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,qBAAW,CAAC,YAAY;QAC7C,GAAG,CAAC,UAAU,KAAK,SAAS;QAC5B,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,KAAK;QACxB,GAAG,CAAC,YAAY,KAAK,SAAS;QAC9B,CAAC,IAAA,sCAAoB,EAAC,GAAG,CAAC,YAAY,CAAC,EACvC,CAAC;QACD,MAAM,OAAO,CACX,iCAAiC,CAAC,kBAAkB,EACpD,6GAA6G,CAC9G,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,oCAA0B,EAAC;QACzC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;QAC7B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,UAAU,EAAE,SAAS;KACtB,CAAC,CAAC;IACH,IAAI,OAAO,KAAK,mCAAyB,CAAC,QAAQ,EAAE,CAAC;QACnD,MAAM,OAAO,CACX,iCAAiC,CAAC,gBAAgB,EAClD,+CAA+C,SAAS,GAAG,CAC5D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,IAAuC,EAAE,OAAe;IACvE,OAAO,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AACnD,CAAC"}
|
|
@@ -3,6 +3,7 @@ import { type RequestContext } from '@xemahq/platform-common';
|
|
|
3
3
|
export declare class UnevaluableSubjectError extends Error {
|
|
4
4
|
constructor(kind: string);
|
|
5
5
|
}
|
|
6
|
+
export declare function isEvaluableSubject(caller: AuthzCaller): boolean;
|
|
6
7
|
export declare function authzenSubjectFromContext(ctx: RequestContext): XemaAuthzenSubject;
|
|
7
8
|
export declare function authzenContextFromRequest(ctx: RequestContext, extra?: {
|
|
8
9
|
readonly capability?: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"subject-from-context.d.ts","sourceRoot":"","sources":["../src/subject-from-context.ts"],"names":[],"mappings":"AAAA,OAAO,
|
|
1
|
+
{"version":3,"file":"subject-from-context.d.ts","sourceRoot":"","sources":["../src/subject-from-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,yBAAyB,CAAC;AASjC,qBAAa,uBAAwB,SAAQ,KAAK;gBAC7B,IAAI,EAAE,MAAM;CAOhC;AAMD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAE/D;AAgBD,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,cAAc,GAClB,kBAAkB,CAgBpB;AAGD,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,cAAc,EACnB,KAAK,GAAE;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1E,kBAAkB,CAYpB;AAWD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC;CACxD;AAGD,MAAM,MAAM,WAAW,GAAG,cAAc,GAAG,cAAc,CAAC;AAE1D,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,IAAI,cAAc,CAE9E;AAGD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,kBAAkB,CAQxE;AAGD,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,WAAW,EACnB,KAAK,GAAE;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1E,kBAAkB,CAapB;AAGD,wBAAgB,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAMtD"}
|
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.UnevaluableSubjectError = void 0;
|
|
4
|
+
exports.isEvaluableSubject = isEvaluableSubject;
|
|
4
5
|
exports.authzenSubjectFromContext = authzenSubjectFromContext;
|
|
5
6
|
exports.authzenContextFromRequest = authzenContextFromRequest;
|
|
6
7
|
exports.isAuthzPrincipal = isAuthzPrincipal;
|
|
@@ -18,12 +19,10 @@ class UnevaluableSubjectError extends Error {
|
|
|
18
19
|
}
|
|
19
20
|
}
|
|
20
21
|
exports.UnevaluableSubjectError = UnevaluableSubjectError;
|
|
21
|
-
const EVALUABLE_KINDS = new Set(
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
subject_1.SubjectKind.ExternalSubject,
|
|
26
|
-
]);
|
|
22
|
+
const EVALUABLE_KINDS = new Set(authzen_1.XEMA_AUTHZEN_SUBJECT_KINDS);
|
|
23
|
+
function isEvaluableSubject(caller) {
|
|
24
|
+
return EVALUABLE_KINDS.has(caller.subject.kind);
|
|
25
|
+
}
|
|
27
26
|
function authzenSubjectFromContext(ctx) {
|
|
28
27
|
const { kind, id } = ctx.subject;
|
|
29
28
|
if (!EVALUABLE_KINDS.has(kind)) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"subject-from-context.js","sourceRoot":"","sources":["../src/subject-from-context.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"subject-from-context.js","sourceRoot":"","sources":["../src/subject-from-context.ts"],"names":[],"mappings":";;;AAkCA,gDAEC;AAgBD,8DAkBC;AAGD,8DAeC;AAqBD,4CAEC;AAGD,4CAQC;AAGD,4CAgBC;AAGD,gCAMC;AAtJD,uDAKmC;AACnC,uDAAwD;AACxD,6DAIiC;AASjC,MAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAmB,IAAY;QAC7B,KAAK,CACH,+BAA+B,IAAI,qDAAqD;YACtF,2CAA2C,CAC9C,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC;IAC3C,CAAC;CACF;AARD,0DAQC;AAGD,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,oCAA0B,CAAC,CAAC;AAGjF,SAAgB,kBAAkB,CAAC,MAAmB;IACpD,OAAO,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC;AAgBD,SAAgB,yBAAyB,CACvC,GAAmB;IAEnB,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC;IACjC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,UAAU,GACd,IAAI,KAAK,qBAAW,CAAC,IAAI;QACvB,CAAC,CAAC,IAAA,+CAA6B,EAAC,GAAG,EAAE,yBAAO,CAAC,KAAK,CAAC;QACnD,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,kCAAwB,CAAC,KAAK,CAAC;QACpC,IAAI,EAAE,IAAI;QACV,EAAE;QACF,GAAG,CAAC,UAAU,KAAK,SAAS;YAC1B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,CAAC;KAClD,CAAC,CAAC;AACL,CAAC;AAGD,SAAgB,yBAAyB,CACvC,GAAmB,EACnB,QAAyE,EAAE;IAE3E,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3E,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9E,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;KACxE,CAAC;AACJ,CAAC;AAqBD,SAAgB,gBAAgB,CAAC,MAAmB;IAClD,OAAQ,MAAkC,CAAC,IAAI,KAAK,WAAW,CAAC;AAClE,CAAC;AAGD,SAAgB,gBAAgB,CAAC,MAAmB;IAClD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,kCAAwB,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;AAC9F,CAAC;AAGD,SAAgB,gBAAgB,CAC9B,MAAmB,EACnB,QAAyE,EAAE;IAE3E,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,yBAAyB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3E,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9E,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;KAC9E,CAAC;AACJ,CAAC;AAGD,SAAgB,UAAU,CAAC,MAAmB;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
|
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import { type AuthzenSubject } from '@xemahq/contracts/authzen';
|
|
2
|
+
import { ExecutionEnvironmentKind } from '@xemahq/contracts/execution-environment';
|
|
2
3
|
import { type XemaAnchorSearchContext } from './anchor-predicate';
|
|
3
4
|
import { type AuthzenPdpTransport } from './authzen.transport';
|
|
4
5
|
import { type AuthzCaller } from './subject-from-context';
|
|
@@ -8,7 +9,7 @@ export interface AuthzResourceRef {
|
|
|
8
9
|
}
|
|
9
10
|
export interface AuthzCheckOptions {
|
|
10
11
|
readonly capability?: string;
|
|
11
|
-
readonly environment?:
|
|
12
|
+
readonly environment?: ExecutionEnvironmentKind;
|
|
12
13
|
}
|
|
13
14
|
export interface AuthzDecision {
|
|
14
15
|
readonly allowed: boolean;
|
|
@@ -25,7 +26,8 @@ export declare class XemaAuthz {
|
|
|
25
26
|
private readonly transport;
|
|
26
27
|
constructor(transport: AuthzenPdpTransport);
|
|
27
28
|
evaluate(ctx: AuthzCaller, action: string, resource: AuthzResourceRef, options?: AuthzCheckOptions): Promise<AuthzDecision>;
|
|
28
|
-
evaluateCapability(ctx: AuthzCaller, capabilityRef: string, environment:
|
|
29
|
+
evaluateCapability(ctx: AuthzCaller, capabilityRef: string, environment: ExecutionEnvironmentKind): Promise<AuthzDecision>;
|
|
30
|
+
evaluateSystemCapability(serviceSubjectId: string, capabilityRef: string): Promise<AuthzDecision>;
|
|
29
31
|
assert(ctx: AuthzCaller, view: string, action: string, resource: AuthzResourceRef, options?: AuthzCheckOptions): Promise<void>;
|
|
30
32
|
allowed(ctx: AuthzCaller, actions: readonly string[], resources: readonly AuthzResourceRef[], options?: AuthzCheckOptions): Promise<boolean[][]>;
|
|
31
33
|
searchResources(ctx: AuthzCaller, type: string, action: string, page?: {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"xema-authz.service.d.ts","sourceRoot":"","sources":["../src/xema-authz.service.ts"],"names":[],"mappings":"AAMA,OAAO,
|
|
1
|
+
{"version":3,"file":"xema-authz.service.d.ts","sourceRoot":"","sources":["../src/xema-authz.service.ts"],"names":[],"mappings":"AAMA,OAAO,EAYL,KAAK,cAAc,EACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AAGnF,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,wBAAwB,CAAC;AAGhC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAEhC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,CAAC,EAAE,wBAAwB,CAAC;CACjD;AAGD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAExC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;CACjE;AAGD,MAAM,WAAW,iBAAiB;IAEhC,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;IAKhC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAErD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC;AAwBD,qBACa,SAAS;IAGlB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,mBAAmB;IAIpC,QAAQ,CACnB,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,aAAa,CAAC;IAwBZ,kBAAkB,CAC7B,GAAG,EAAE,WAAW,EAChB,aAAa,EAAE,MAAM,EAErB,WAAW,EAAE,wBAAwB,GACpC,OAAO,CAAC,aAAa,CAAC;IA2BZ,wBAAwB,CAEnC,gBAAgB,EAAE,MAAM,EACxB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,aAAa,CAAC;IAkBZ,MAAM,CACjB,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,IAAI,CAAC;IAqBH,OAAO,CAClB,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,SAAS,EAAE,SAAS,gBAAgB,EAAE,EACtC,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;IAuCV,eAAe,CAC1B,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,EAC/D,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,iBAAiB,CAAC;IAoChB,oBAAoB,CAC/B,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,MAAM,EAAE,CAAC;IAuBP,cAAc,CACzB,GAAG,EAAE,WAAW,EAChB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,cAAc,EAAE,CAAC;IAmBf,aAAa,CACxB,GAAG,EAAE,WAAW,EAChB,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,MAAM,EAAE,CAAC;IAYpB,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,QAAQ;CAGjB"}
|
|
@@ -15,15 +15,25 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
15
15
|
exports.XemaAuthz = void 0;
|
|
16
16
|
const common_1 = require("@nestjs/common");
|
|
17
17
|
const authzen_1 = require("@xemahq/contracts/authzen");
|
|
18
|
+
const execution_environment_1 = require("@xemahq/contracts/execution-environment");
|
|
19
|
+
const subject_1 = require("@xemahq/contracts/subject");
|
|
18
20
|
const anchor_predicate_1 = require("./anchor-predicate");
|
|
19
21
|
const authzen_transport_1 = require("./authzen.transport");
|
|
20
22
|
const subject_from_context_1 = require("./subject-from-context");
|
|
23
|
+
const SUBJECT_NOT_EVALUABLE = {
|
|
24
|
+
allowed: false,
|
|
25
|
+
reasonCode: authzen_1.XemaAuthzenReasonCode.SubjectNotEvaluable,
|
|
26
|
+
context: undefined,
|
|
27
|
+
};
|
|
21
28
|
let XemaAuthz = class XemaAuthz {
|
|
22
29
|
transport;
|
|
23
30
|
constructor(transport) {
|
|
24
31
|
this.transport = transport;
|
|
25
32
|
}
|
|
26
33
|
async evaluate(ctx, action, resource, options = {}) {
|
|
34
|
+
if (!(0, subject_from_context_1.isEvaluableSubject)(ctx)) {
|
|
35
|
+
return SUBJECT_NOT_EVALUABLE;
|
|
36
|
+
}
|
|
27
37
|
const response = await this.transport.evaluation((0, subject_from_context_1.authzOrgOf)(ctx), {
|
|
28
38
|
subject: this.subject(ctx),
|
|
29
39
|
action: { name: action },
|
|
@@ -33,6 +43,9 @@ let XemaAuthz = class XemaAuthz {
|
|
|
33
43
|
return toDecision(response);
|
|
34
44
|
}
|
|
35
45
|
async evaluateCapability(ctx, capabilityRef, environment) {
|
|
46
|
+
if (!(0, subject_from_context_1.isEvaluableSubject)(ctx)) {
|
|
47
|
+
return SUBJECT_NOT_EVALUABLE;
|
|
48
|
+
}
|
|
36
49
|
const orgId = (0, subject_from_context_1.authzOrgOf)(ctx);
|
|
37
50
|
const response = await this.transport.evaluation(orgId, {
|
|
38
51
|
subject: this.subject(ctx),
|
|
@@ -45,6 +58,17 @@ let XemaAuthz = class XemaAuthz {
|
|
|
45
58
|
});
|
|
46
59
|
return toDecision(response);
|
|
47
60
|
}
|
|
61
|
+
async evaluateSystemCapability(serviceSubjectId, capabilityRef) {
|
|
62
|
+
const response = await this.transport.evaluation(null, {
|
|
63
|
+
subject: { type: subject_1.SubjectKind.Service, id: serviceSubjectId },
|
|
64
|
+
action: { name: authzen_1.XEMA_CAPABILITY_INVOKE_ACTION },
|
|
65
|
+
resource: {
|
|
66
|
+
type: authzen_1.XEMA_CAPABILITY_RESOURCE_TYPE,
|
|
67
|
+
id: (0, authzen_1.capabilityResourceId)(null, capabilityRef, execution_environment_1.ExecutionEnvironmentKind.System),
|
|
68
|
+
},
|
|
69
|
+
});
|
|
70
|
+
return toDecision(response);
|
|
71
|
+
}
|
|
48
72
|
async assert(ctx, view, action, resource, options = {}) {
|
|
49
73
|
const actions = view === action ? [view] : [view, action];
|
|
50
74
|
const [decisions] = await this.allowed(ctx, actions, [resource], options);
|
|
@@ -65,6 +89,9 @@ let XemaAuthz = class XemaAuthz {
|
|
|
65
89
|
if (actions.length === 0 || resources.length === 0) {
|
|
66
90
|
return resources.map(() => []);
|
|
67
91
|
}
|
|
92
|
+
if (!(0, subject_from_context_1.isEvaluableSubject)(ctx)) {
|
|
93
|
+
return resources.map(() => actions.map(() => false));
|
|
94
|
+
}
|
|
68
95
|
const subject = this.subject(ctx);
|
|
69
96
|
const context = (0, subject_from_context_1.authzenContextOf)(ctx, options);
|
|
70
97
|
const evaluations = [];
|
|
@@ -87,6 +114,9 @@ let XemaAuthz = class XemaAuthz {
|
|
|
87
114
|
return resources.map((_, r) => actions.map((__, a) => decisions[r * actions.length + a]?.decision === true));
|
|
88
115
|
}
|
|
89
116
|
async searchResources(ctx, type, action, page = {}, options = {}) {
|
|
117
|
+
if (!(0, subject_from_context_1.isEvaluableSubject)(ctx)) {
|
|
118
|
+
return { ids: [], anchor: undefined, nextToken: authzen_1.AUTHZEN_LAST_PAGE_TOKEN, snapshot: undefined };
|
|
119
|
+
}
|
|
90
120
|
const response = await this.transport.searchResource((0, subject_from_context_1.authzOrgOf)(ctx), {
|
|
91
121
|
subject: this.subject(ctx),
|
|
92
122
|
action: { name: action },
|
|
@@ -143,6 +173,9 @@ let XemaAuthz = class XemaAuthz {
|
|
|
143
173
|
return subjects;
|
|
144
174
|
}
|
|
145
175
|
async searchActions(ctx, resource) {
|
|
176
|
+
if (!(0, subject_from_context_1.isEvaluableSubject)(ctx)) {
|
|
177
|
+
return [];
|
|
178
|
+
}
|
|
146
179
|
const response = await this.transport.searchAction((0, subject_from_context_1.authzOrgOf)(ctx), {
|
|
147
180
|
subject: this.subject(ctx),
|
|
148
181
|
resource: this.resource(ctx, resource),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"xema-authz.service.js","sourceRoot":"","sources":["../src/xema-authz.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAKwB;AACxB,
|
|
1
|
+
{"version":3,"file":"xema-authz.service.js","sourceRoot":"","sources":["../src/xema-authz.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAKwB;AACxB,uDAamC;AACnC,mFAAmF;AACnF,uDAAwD;AAExD,yDAG4B;AAC5B,2DAG6B;AAC7B,iEAMgC;AAwChC,MAAM,qBAAqB,GAAkB;IAC3C,OAAO,EAAE,KAAK;IACd,UAAU,EAAE,+BAAqB,CAAC,mBAAmB;IACrD,OAAO,EAAE,SAAS;CACnB,CAAC;AAkBK,IAAM,SAAS,GAAf,MAAM,SAAS;IAGD;IAFnB,YAEmB,SAA8B;QAA9B,cAAS,GAAT,SAAS,CAAqB;IAC9C,CAAC;IAGG,KAAK,CAAC,QAAQ,CACnB,GAAgB,EAChB,MAAc,EACd,QAA0B,EAC1B,UAA6B,EAAE;QAE/B,IAAI,CAAC,IAAA,yCAAkB,EAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,qBAAqB,CAAC;QAC/B,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAA,iCAAU,EAAC,GAAG,CAAC,EAAE;YAChE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;YACtC,OAAO,EAAE,IAAA,uCAAgB,EAAC,GAAG,EAAE,OAAO,CAAC;SACxC,CAAC,CAAC;QACH,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAaM,KAAK,CAAC,kBAAkB,CAC7B,GAAgB,EAChB,aAAqB,EAErB,WAAqC;QAErC,IAAI,CAAC,IAAA,yCAAkB,EAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,qBAAqB,CAAC;QAC/B,CAAC;QACD,MAAM,KAAK,GAAG,IAAA,iCAAU,EAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE;YACtD,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,uCAA6B,EAAE;YAC/C,QAAQ,EAAE;gBACR,IAAI,EAAE,uCAA6B;gBACnC,EAAE,EAAE,IAAA,8BAAoB,EAAC,KAAK,EAAE,aAAa,EAAE,WAAW,CAAC;aAC5D;YACD,OAAO,EAAE,IAAA,uCAAgB,EAAC,GAAG,CAAC;SAC/B,CAAC,CAAC;QACH,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAYM,KAAK,CAAC,wBAAwB,CAEnC,gBAAwB,EACxB,aAAqB;QAErB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE;YACrD,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,OAAO,EAAE,EAAE,EAAE,gBAAgB,EAAE;YAC5D,MAAM,EAAE,EAAE,IAAI,EAAE,uCAA6B,EAAE;YAC/C,QAAQ,EAAE;gBACR,IAAI,EAAE,uCAA6B;gBACnC,EAAE,EAAE,IAAA,8BAAoB,EAAC,IAAI,EAAE,aAAa,EAAE,gDAAwB,CAAC,MAAM,CAAC;aAC/E;SACF,CAAC,CAAC;QACH,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAQM,KAAK,CAAC,MAAM,CACjB,GAAgB,EAChB,IAAY,EACZ,MAAc,EACd,QAA0B,EAC1B,UAA6B,EAAE;QAE/B,MAAM,OAAO,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1E,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACrD,MAAM,IAAI,0BAAiB,CAAC;gBAC1B,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,kBAAkB;aAC5D,CAAC,CAAC;QACL,CAAC;QACD,IAAI,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,IAAI,MAAM,yBAAyB,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,IAAI;aAC9E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAMM,KAAK,CAAC,OAAO,CAClB,GAAgB,EAChB,OAA0B,EAC1B,SAAsC,EACtC,UAA6B,EAAE;QAE/B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnD,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,CAAC,IAAA,yCAAkB,EAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,IAAA,uCAAgB,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,WAAW,GAA2D,EAAE,CAAC;QAC/E,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC/C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAA,iCAAU,EAAC,GAAG,CAAC,EAAE;YACjE,OAAO;YACP,OAAO;YACP,WAAW;YACX,OAAO,EAAE,EAAE,oBAAoB,EAAE,oCAA0B,CAAC,UAAU,EAAE;SACzE,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAC;QACvC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CACb,8BAA8B,SAAS,EAAE,MAAM,IAAI,CAAC,OAAO,WAAW,CAAC,MAAM,iCAAiC,CAC/G,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC5B,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI,CAAC,CAC7E,CAAC;IACJ,CAAC;IAQM,KAAK,CAAC,eAAe,CAC1B,GAAgB,EAChB,IAAY,EACZ,MAAc,EACd,OAA6D,EAAE,EAC/D,UAA6B,EAAE;QAE/B,IAAI,CAAC,IAAA,yCAAkB,EAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,iCAAuB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QACjG,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAA,iCAAU,EAAC,GAAG,CAAC,EAAE;YACpE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACxB,QAAQ,EAAE,EAAE,IAAI,EAAE;YAClB,OAAO,EAAE,IAAA,uCAAgB,EAAC,GAAG,EAAE,OAAO,CAAC;YACvC,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;gBACtD,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC;SAC3B,CAAC,CAAC;QACH,MAAM,MAAM,GACV,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,SAAS;YACxC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,gDAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtE,MAAM,aAAa,GAAG,0CAAgC,CAAC,SAAS,CAC9D,QAAQ,CAAC,OAAO,IAAI,EAAE,CACvB,CAAC;QACF,OAAO;YACL,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC9B,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;oBACpB,MAAM,IAAI,KAAK,CACb,wBAAwB,IAAI,iBAAiB,CAAC,CAAC,IAAI,0BAA0B,CAC9E,CAAC;gBACJ,CAAC;gBACD,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACzB,CAAC,CAAC;YACF,MAAM;YACN,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,IAAI,iCAAuB;YAC/D,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;SAC1E,CAAC;IACJ,CAAC;IAGM,KAAK,CAAC,oBAAoB,CAC/B,GAAgB,EAChB,IAAY,EACZ,MAAc,EACd,UAA6B,EAAE;QAE/B,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,IAAI,KAAyB,CAAC;QAC9B,GAAG,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CACrC,GAAG,EACH,IAAI,EACJ,MAAM,EACN,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EACpC,OAAO,CACR,CAAC;YACF,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CACb,kBAAkB,IAAI,uEAAuE,CAC9F,CAAC;YACJ,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,KAAK,GAAG,IAAI,CAAC,SAAS,KAAK,iCAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;QAClF,CAAC,QAAQ,KAAK,KAAK,SAAS,EAAE;QAC9B,OAAO,GAAG,CAAC;IACb,CAAC;IAGM,KAAK,CAAC,cAAc,CACzB,GAAgB,EAChB,WAAmB,EACnB,MAAc,EACd,QAA0B;QAE1B,MAAM,QAAQ,GAAqB,EAAE,CAAC;QACtC,IAAI,KAAyB,CAAC;QAC9B,GAAG,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,IAAA,iCAAU,EAAC,GAAG,CAAC,EAAE;gBACnE,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;gBAC9B,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;gBACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;gBACtC,OAAO,EAAE,IAAA,uCAAgB,EAAC,GAAG,CAAC;gBAC9B,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;aACpD,CAAC,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,UAAU,IAAI,iCAAuB,CAAC;YAClE,KAAK,GAAG,IAAI,KAAK,iCAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,CAAC,QAAQ,KAAK,KAAK,SAAS,EAAE;QAC9B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAGM,KAAK,CAAC,aAAa,CACxB,GAAgB,EAChB,QAA0B;QAE1B,IAAI,CAAC,IAAA,yCAAkB,EAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAA,iCAAU,EAAC,GAAG,CAAC,EAAE;YAClE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;YACtC,OAAO,EAAE,IAAA,uCAAgB,EAAC,GAAG,CAAC;SAC/B,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IAEO,OAAO,CAAC,GAAgB;QAC9B,OAAO,IAAA,uCAAgB,EAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAEO,QAAQ,CAAC,GAAgB,EAAE,GAAqB;QACtD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,IAAA,2BAAiB,EAAC,IAAA,iCAAU,EAAC,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;IAC5E,CAAC;CACF,CAAA;AArRY,8BAAS;oBAAT,SAAS;IADrB,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,yCAAqB,CAAC,CAAA;;GAFrB,SAAS,CAqRrB;AAED,SAAS,UAAU,CAAC,QAAyB;IAC3C,MAAM,MAAM,GAAG,0CAAgC,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAClF,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,QAAQ,KAAK,IAAI;QACnC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAChE,OAAO,EAAE,QAAQ,CAAC,OAAO;KAC1B,CAAC;AACJ,CAAC;AAGD,SAAS,SAAS,CAAC,SAAiB;IAClC,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,+CAA+C,SAAS,IAAI,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AACpC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@xemahq/authorization-nest",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.3.0",
|
|
4
4
|
"description": "AuthZEN 1.0 PEP for Xema services: one Nest module, an AuthZEN client against authorization-api, and the @Authorize route guard.",
|
|
5
5
|
"publishConfig": {
|
|
6
6
|
"registry": "https://registry.npmjs.org/",
|
|
@@ -24,11 +24,11 @@
|
|
|
24
24
|
"@nestjs/common": "11.1.18",
|
|
25
25
|
"@nestjs/core": "11.1.18",
|
|
26
26
|
"@nestjs/testing": "11.1.18",
|
|
27
|
-
"@xemahq/contracts": "
|
|
27
|
+
"@xemahq/contracts": ">=0.48.0",
|
|
28
28
|
"@xemahq/eslint-config": "^0.5.0",
|
|
29
|
-
"@xemahq/identity-client": "^0.
|
|
30
|
-
"@xemahq/platform-common": "^0.
|
|
31
|
-
"@xemahq/service-registry-nest": "^0.
|
|
29
|
+
"@xemahq/identity-client": "^0.15.4",
|
|
30
|
+
"@xemahq/platform-common": "^0.58.0",
|
|
31
|
+
"@xemahq/service-registry-nest": "^0.19.0",
|
|
32
32
|
"@types/jest": "^30.0.0",
|
|
33
33
|
"@types/node": "25.2.3",
|
|
34
34
|
"eslint": "^9.39.4",
|