@zauru-sdk/utils 6.20.0 → 6.22.0

package/dist/esm/index.js

@@ -26,6 +26,7 @@ export * from "./zauru/rejectionPercentageAdjustmentRules.utils.js";
 export * from "./zauru/weeklyItemPrice.utils.js";
 export * from "./zauru/templates.utils.js";
 export * from "./zauru/tiposMuestra.utils.js";
+export * from "./zauru/rbac/index.js";
 export * from "./zauru/webapp-tables.utils.js";
 export * from "./zauru/4pinos-po-discount-history.utils.js";
 export * from "./zauru/programaciones.utils.js";

package/dist/esm/zauru/auth.loaders.js

@@ -41,7 +41,7 @@ export function createLoginAction(extras) {
             return redirect(authorizeUrl(request));
         }
         if (session.has("code")) {
-            if (isDenied(extras?.requireAccess?.(session))) {
+            if (isDenied(await extras?.requireAccess?.(session))) {
                 return redirect("/");
             }
             return redirect("/home");
@@ -50,7 +50,7 @@ export function createLoginAction(extras) {
         if (loginResponse.error || !loginResponse.data) {
             return Response.json(loginErrorPayload(loginResponse.userMsg?.toString() ?? ""));
         }
-        if (isDenied(extras?.requireAccess?.(session))) {
+        if (isDenied(await extras?.requireAccess?.(session))) {
             return Response.json(loginErrorPayload("No tienes permiso para acceder a esta aplicación. Si crees que esto es un error, contacta al administrador.", "Acceso denegado"));
         }
         if (extras?.afterLogin) {
@@ -78,7 +78,7 @@ export function createSessionGuardLoader(extras) {
         if (!session.has("username")) {
             return redirect("/");
         }
-        if (isDenied(extras?.requireAccess?.(session))) {
+        if (isDenied(await extras?.requireAccess?.(session))) {
             return redirect("/");
         }
         return Response.json({});
@@ -104,7 +104,7 @@ export function createIndexLoader(extras) {
     return async ({ request }) => {
         const session = await getSession(request.headers.get("Cookie"));
         if (session.has("username")) {
-            if (isDenied(extras?.requireAccess?.(session))) {
+            if (isDenied(await extras?.requireAccess?.(session))) {
                 return Response.json({});
             }
             return redirect("/home");
@@ -121,7 +121,7 @@ export function createReloadCatalogsLoader(extras) {
         if (!session.has("username")) {
             return redirect("/");
         }
-        if (isDenied(extras?.requireAccess?.(session))) {
+        if (isDenied(await extras?.requireAccess?.(session))) {
             return redirect("/");
         }
         try {

package/dist/esm/zauru/rbac/access.js

@@ -0,0 +1,35 @@
+import { DEFAULT_SUPER_ADMIN_EMAIL_SUFFIXES } from "./catalog.js";
+export function isSuperAdminEmail(email, suffixes = DEFAULT_SUPER_ADMIN_EMAIL_SUFFIXES) {
+    if (!email) {
+        return false;
+    }
+    const normalized = email.toLowerCase().trim();
+    return suffixes.some((suffix) => normalized.endsWith(suffix.toLowerCase()));
+}
+export function hasPermissionKey(superAdmin, permissionKeys, key) {
+    if (superAdmin) {
+        return true;
+    }
+    return (permissionKeys ?? []).includes(key);
+}
+export function hasPermission(context, key) {
+    if (!context) {
+        return false;
+    }
+    return hasPermissionKey(context.superAdmin, context.permissionKeys, key);
+}
+export function isActiveWebappRow(row) {
+    return Boolean(row?.data) && !row?.data?.fechaEliminacion;
+}
+export function emptyAccessContext(employeeId, email) {
+    return {
+        employeeId,
+        email,
+        superAdmin: false,
+        roleId: null,
+        roleName: null,
+        assignmentId: null,
+        assignment: null,
+        permissionKeys: [],
+    };
+}

package/dist/esm/zauru/rbac/catalog.js

@@ -0,0 +1,67 @@
+export const DEFAULT_SUPER_ADMIN_EMAIL_SUFFIXES = [
+    "@zauru.com",
+    "@intuitiva.biz",
+];
+export function flattenPermissionRows(groups) {
+    return groups.flatMap((group) => group.actions.map((action) => ({
+        groupId: group.id,
+        groupLabel: group.label,
+        key: action.key,
+        label: action.label,
+    })));
+}
+export function allPermissionKeysFromGroups(groups) {
+    return flattenPermissionRows(groups).map((row) => row.key);
+}
+export function isValidPermissionKey(key, validKeys) {
+    if (Array.isArray(validKeys)) {
+        return validKeys.includes(key);
+    }
+    return validKeys.has(key);
+}
+export function normalizePermissionKeys(value) {
+    if (Array.isArray(value)) {
+        return value.filter((key) => typeof key === "string");
+    }
+    if (typeof value === "string") {
+        const trimmed = value.trim();
+        if (!trimmed) {
+            return [];
+        }
+        try {
+            const parsed = JSON.parse(trimmed);
+            if (Array.isArray(parsed)) {
+                return parsed.filter((key) => typeof key === "string");
+            }
+        }
+        catch {
+            return [trimmed];
+        }
+    }
+    return [];
+}
+export function normalizeIdList(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value
+        .map((item) => Number(item))
+        .filter((item) => Number.isFinite(item) && item > 0);
+}
+export function togglePermissionKey(keys, key, granted) {
+    const next = new Set(keys);
+    if (granted) {
+        next.add(key);
+    }
+    else {
+        next.delete(key);
+    }
+    return [...next];
+}
+export function addPermissionKeys(keys, add) {
+    return [...new Set([...keys, ...add])];
+}
+export function removePermissionKeys(keys, remove) {
+    const drop = new Set(remove);
+    return keys.filter((key) => !drop.has(key));
+}

package/dist/esm/zauru/rbac/createWebappRbac.js

@@ -0,0 +1,248 @@
+import { redirect } from "@remix-run/node";
+import { handlePossibleAxiosErrors } from "@zauru-sdk/common";
+import { createWebAppTableRegister, getVariablesByName, getWebAppRow, getWebAppTableRegisters, updateWebAppTableRegister, } from "@zauru-sdk/services";
+import { hasPermission as hasPermissionInContext, isActiveWebappRow, isSuperAdminEmail, } from "./access.js";
+import { DEFAULT_SUPER_ADMIN_EMAIL_SUFFIXES, isValidPermissionKey, normalizePermissionKeys, } from "./catalog.js";
+const deletedAt = () => new Date().toISOString();
+const toNumber = (value) => {
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : 0;
+};
+export function createWebappRbac(config) {
+    const suffixes = config.superAdminEmailSuffixes ?? DEFAULT_SUPER_ADMIN_EMAIL_SUFFIXES;
+    const validKeys = new Set(config.allPermissionKeys);
+    const getTableIds = async (headers, session) => {
+        const vars = await getVariablesByName(headers, session, [
+            config.rolesTableVar,
+            config.employeeRolesTableVar,
+        ]);
+        return {
+            rolesTableId: vars[config.rolesTableVar],
+            employeeRolesTableId: vars[config.employeeRolesTableVar],
+        };
+    };
+    const sanitizeKeys = (keys) => normalizePermissionKeys(keys).filter((key) => isValidPermissionKey(key, validKeys));
+    const listRoles = (headers, session) => handlePossibleAxiosErrors(async () => {
+        const { rolesTableId } = await getTableIds(headers, session);
+        const response = await getWebAppTableRegisters(session, rolesTableId);
+        if (response.error) {
+            throw new Error(`Ocurrió un error al consultar los roles: ${response.userMsg}`);
+        }
+        return (response.data ?? [])
+            .filter(isActiveWebappRow)
+            .map((row) => ({
+            ...row,
+            data: {
+                ...row.data,
+                permission_keys: sanitizeKeys(row.data.permission_keys),
+            },
+        }));
+    });
+    const getRoleById = (session, roleId) => handlePossibleAxiosErrors(async () => {
+        const response = await getWebAppRow(session, roleId);
+        if (response.error) {
+            throw new Error(`Ocurrió un error al consultar el rol: ${response.userMsg}`);
+        }
+        if (!response.data || response.data.fechaEliminacion) {
+            return null;
+        }
+        return {
+            ...response.data,
+            permission_keys: sanitizeKeys(response.data.permission_keys),
+        };
+    });
+    const listEmployeeRoles = (headers, session, employeeId) => handlePossibleAxiosErrors(async () => {
+        const { employeeRolesTableId } = await getTableIds(headers, session);
+        const response = await getWebAppTableRegisters(session, employeeRolesTableId, employeeId
+            ? { data: { employee_id: employeeId } }
+            : undefined);
+        if (response.error) {
+            throw new Error(`Ocurrió un error al consultar las asignaciones de rol: ${response.userMsg}`);
+        }
+        const rows = (response.data ?? []).filter(isActiveWebappRow);
+        if (employeeId == null) {
+            return rows;
+        }
+        return rows.filter((row) => Number(row.data.employee_id) === Number(employeeId));
+    });
+    const createRole = (headers, session, body) => handlePossibleAxiosErrors(async () => {
+        const name = body.name.trim();
+        if (!name) {
+            throw new Error("El nombre del rol es requerido.");
+        }
+        const { rolesTableId } = await getTableIds(headers, session);
+        return createWebAppTableRegister(headers, rolesTableId, {
+            name,
+            description: body.description?.trim() ?? "",
+            permission_keys: sanitizeKeys(body.permission_keys),
+            fechaEliminacion: "",
+        });
+    });
+    const updateRole = (headers, session, roleId, body) => handlePossibleAxiosErrors(async () => {
+        const { rolesTableId } = await getTableIds(headers, session);
+        const current = await getWebAppRow(session, roleId);
+        if (current.error || !current.data || current.data.fechaEliminacion) {
+            throw new Error("El rol no existe o fue eliminado.");
+        }
+        const next = {
+            name: body.name?.trim() || current.data.name,
+            description: body.description !== undefined
+                ? body.description.trim()
+                : (current.data.description ?? ""),
+            permission_keys: body.permission_keys !== undefined
+                ? sanitizeKeys(body.permission_keys)
+                : sanitizeKeys(current.data.permission_keys),
+            fechaEliminacion: current.data.fechaEliminacion ?? "",
+        };
+        return updateWebAppTableRegister(headers, rolesTableId, roleId, next);
+    });
+    const deleteRole = (headers, session, roleId) => handlePossibleAxiosErrors(async () => {
+        const assignments = await listEmployeeRoles(headers, session);
+        if (assignments.error) {
+            throw new Error(assignments.userMsg ?? "No se pudieron consultar las asignaciones.");
+        }
+        const inUse = (assignments.data ?? []).some((row) => Number(row.data.role_id) === Number(roleId));
+        if (inUse) {
+            throw new Error("No se puede eliminar el rol: hay empleados asignados. Reasígnalos primero.");
+        }
+        const { rolesTableId } = await getTableIds(headers, session);
+        const current = await getWebAppRow(session, roleId);
+        if (current.error || !current.data) {
+            throw new Error("El rol no existe.");
+        }
+        return updateWebAppTableRegister(headers, rolesTableId, roleId, {
+            ...current.data,
+            permission_keys: sanitizeKeys(current.data.permission_keys),
+            fechaEliminacion: deletedAt(),
+        });
+    });
+    const syncRolePermissionKeys = (headers, session, roleId, keys) => updateRole(headers, session, roleId, { permission_keys: keys });
+    const assignEmployeeRole = (headers, session, body) => handlePossibleAxiosErrors(async () => {
+        const employeeId = toNumber(body.employee_id);
+        if (!employeeId) {
+            throw new Error("El empleado es requerido.");
+        }
+        const existing = await listEmployeeRoles(headers, session, employeeId);
+        if (existing.error) {
+            throw new Error(existing.userMsg ?? "No se pudieron consultar las asignaciones.");
+        }
+        const current = existing.data?.[0];
+        const { employeeRolesTableId } = await getTableIds(headers, session);
+        if (body.role_id == null) {
+            if (!current) {
+                return {
+                    id: 0,
+                    webapp_table_id: Number(employeeRolesTableId),
+                    data: { Nombre: "" },
+                    creator_id: 0,
+                    updater_id: null,
+                    created_at: "",
+                    updated_at: "",
+                };
+            }
+            return updateWebAppTableRegister(headers, employeeRolesTableId, current.id, {
+                ...current.data,
+                fechaEliminacion: deletedAt(),
+            });
+        }
+        const payload = {
+            ...current?.data,
+            ...(body.extra ?? {}),
+            employee_id: employeeId,
+            role_id: toNumber(body.role_id),
+            fechaEliminacion: "",
+        };
+        if (current) {
+            return updateWebAppTableRegister(headers, employeeRolesTableId, current.id, payload);
+        }
+        return createWebAppTableRegister(headers, employeeRolesTableId, payload);
+    });
+    const resolveAccess = async (headers, session) => {
+        const email = String(session.get("email") ?? "");
+        const employeeId = toNumber(session.get("employee_id"));
+        const superAdmin = isSuperAdminEmail(email, suffixes);
+        if (superAdmin) {
+            return {
+                employeeId,
+                email,
+                superAdmin: true,
+                roleId: null,
+                roleName: null,
+                assignmentId: null,
+                assignment: null,
+                permissionKeys: [...config.allPermissionKeys],
+            };
+        }
+        if (!employeeId) {
+            return null;
+        }
+        const assignments = await listEmployeeRoles(headers, session, employeeId);
+        if (assignments.error) {
+            throw new Error(assignments.userMsg ?? "No se pudieron consultar las asignaciones.");
+        }
+        const assignment = assignments.data?.[0];
+        if (!assignment) {
+            return null;
+        }
+        const roleId = Number(assignment.data.role_id);
+        const role = await getRoleById(session, roleId);
+        if (role.error) {
+            throw new Error(role.userMsg ?? "No se pudo consultar el rol.");
+        }
+        if (!role.data) {
+            return null;
+        }
+        return {
+            employeeId,
+            email,
+            superAdmin: false,
+            roleId,
+            roleName: role.data.name,
+            assignmentId: assignment.id,
+            assignment: assignment.data,
+            permissionKeys: sanitizeKeys(role.data.permission_keys),
+        };
+    };
+    const hasAppAccess = async (headers, session) => {
+        if (isSuperAdminEmail(session.get("email"), suffixes)) {
+            return true;
+        }
+        const context = await resolveAccess(headers, session);
+        return context != null;
+    };
+    const requireAppAccess = async (headers, session) => {
+        if (!session.has("username")) {
+            throw redirect("/");
+        }
+        const context = await resolveAccess(headers, session);
+        if (!context) {
+            throw redirect("/");
+        }
+        return context;
+    };
+    const requirePermission = async (headers, session, key) => {
+        const context = await requireAppAccess(headers, session);
+        if (!hasPermissionInContext(context, key)) {
+            throw redirect("/");
+        }
+        return context;
+    };
+    return {
+        config,
+        getTableIds,
+        listRoles,
+        getRoleById,
+        createRole,
+        updateRole,
+        deleteRole,
+        syncRolePermissionKeys,
+        listEmployeeRoles,
+        assignEmployeeRole,
+        resolveAccess,
+        hasAppAccess,
+        requireAppAccess,
+        requirePermission,
+        hasPermission: hasPermissionInContext,
+        isSuperAdminEmail: (email) => isSuperAdminEmail(email, suffixes),
+    };
+}

package/dist/esm/zauru/rbac/index.js

@@ -0,0 +1,3 @@
+export { addPermissionKeys, allPermissionKeysFromGroups, DEFAULT_SUPER_ADMIN_EMAIL_SUFFIXES, flattenPermissionRows, isValidPermissionKey, normalizeIdList, normalizePermissionKeys, removePermissionKeys, togglePermissionKey, } from "./catalog.js";
+export { emptyAccessContext, hasPermission, hasPermissionKey, isActiveWebappRow, isSuperAdminEmail, } from "./access.js";
+export { createWebappRbac, } from "./createWebappRbac.js";

package/dist/index.d.ts

@@ -26,6 +26,7 @@ export * from "./zauru/rejectionPercentageAdjustmentRules.utils.js";
 export * from "./zauru/weeklyItemPrice.utils.js";
 export * from "./zauru/templates.utils.js";
 export * from "./zauru/tiposMuestra.utils.js";
+export * from "./zauru/rbac/index.js";
 export * from "./zauru/webapp-tables.utils.js";
 export * from "./zauru/4pinos-po-discount-history.utils.js";
 export * from "./zauru/programaciones.utils.js";

package/dist/zauru/auth.loaders.d.ts

@@ -7,7 +7,7 @@ export type AuthAccessExtras = {
      * Return `false` to deny. Throw `redirect(...)` to send the user elsewhere.
      * Any other return (including `void`) allows access.
      */
-    requireAccess?: (session: AuthSession) => boolean | void;
+    requireAccess?: (session: AuthSession) => boolean | void | Promise<boolean | void>;
 };
 export type LoginActionExtras = AuthAccessExtras & {
     afterLogin?: (ctx: {

package/dist/zauru/rbac/access.d.ts

@@ -0,0 +1,8 @@
+import type { WebappAccessContext, WebAppRowGraphQL } from "@zauru-sdk/types";
+export declare function isSuperAdminEmail(email: string | null | undefined, suffixes?: readonly string[]): boolean;
+export declare function hasPermissionKey(superAdmin: boolean | undefined, permissionKeys: readonly string[] | undefined, key: string): boolean;
+export declare function hasPermission(context: WebappAccessContext | null | undefined, key: string): boolean;
+export declare function isActiveWebappRow<T extends {
+    fechaEliminacion?: string;
+}>(row: WebAppRowGraphQL<T> | null | undefined): row is WebAppRowGraphQL<T>;
+export declare function emptyAccessContext(employeeId: number, email: string): WebappAccessContext;

package/dist/zauru/rbac/catalog.d.ts

@@ -0,0 +1,15 @@
+import type { PermissionGroup } from "@zauru-sdk/types";
+export declare const DEFAULT_SUPER_ADMIN_EMAIL_SUFFIXES: readonly ["@zauru.com", "@intuitiva.biz"];
+export declare function flattenPermissionRows(groups: PermissionGroup[]): Array<{
+    groupId: string;
+    groupLabel: string;
+    key: string;
+    label: string;
+}>;
+export declare function allPermissionKeysFromGroups(groups: PermissionGroup[]): string[];
+export declare function isValidPermissionKey(key: string, validKeys: ReadonlySet<string> | readonly string[]): boolean;
+export declare function normalizePermissionKeys(value: unknown): string[];
+export declare function normalizeIdList(value: unknown): number[];
+export declare function togglePermissionKey(keys: readonly string[], key: string, granted: boolean): string[];
+export declare function addPermissionKeys(keys: readonly string[], add: readonly string[]): string[];
+export declare function removePermissionKeys(keys: readonly string[], remove: readonly string[]): string[];

package/dist/zauru/rbac/createWebappRbac.d.ts

@@ -0,0 +1,38 @@
+import { type Session } from "@remix-run/node";
+import type { AxiosUtilsResponse, WebappAccessContext, WebappEmployeeRole, WebappRbacConfig, WebappRole, WebAppRowGraphQL, WebAppTableUpdateResponse } from "@zauru-sdk/types";
+import { hasPermission as hasPermissionInContext } from "./access.js";
+type TableIds = {
+    rolesTableId: string;
+    employeeRolesTableId: string;
+};
+export type CreateRoleInput = {
+    name: string;
+    description?: string;
+    permission_keys?: string[];
+};
+export type UpdateRoleInput = Partial<Pick<WebappRole, "name" | "description" | "permission_keys">>;
+export type AssignEmployeeRoleInput = {
+    employee_id: number;
+    role_id: number | null;
+    extra?: Record<string, unknown>;
+};
+export declare function createWebappRbac(config: WebappRbacConfig): {
+    config: WebappRbacConfig;
+    getTableIds: (headers: any, session: Session) => Promise<TableIds>;
+    listRoles: (headers: any, session: Session) => Promise<AxiosUtilsResponse<WebAppRowGraphQL<WebappRole>[]>>;
+    getRoleById: (session: Session, roleId: number) => Promise<AxiosUtilsResponse<WebappRole | null>>;
+    createRole: (headers: any, session: Session, body: CreateRoleInput) => Promise<AxiosUtilsResponse<WebAppTableUpdateResponse>>;
+    updateRole: (headers: any, session: Session, roleId: number, body: UpdateRoleInput) => Promise<AxiosUtilsResponse<WebAppTableUpdateResponse>>;
+    deleteRole: (headers: any, session: Session, roleId: number) => Promise<AxiosUtilsResponse<WebAppTableUpdateResponse>>;
+    syncRolePermissionKeys: (headers: any, session: Session, roleId: number, keys: string[]) => Promise<AxiosUtilsResponse<WebAppTableUpdateResponse>>;
+    listEmployeeRoles: (headers: any, session: Session, employeeId?: number) => Promise<AxiosUtilsResponse<WebAppRowGraphQL<WebappEmployeeRole>[]>>;
+    assignEmployeeRole: (headers: any, session: Session, body: AssignEmployeeRoleInput) => Promise<AxiosUtilsResponse<WebAppTableUpdateResponse>>;
+    resolveAccess: (headers: any, session: Session) => Promise<WebappAccessContext | null>;
+    hasAppAccess: (headers: any, session: Session) => Promise<boolean>;
+    requireAppAccess: (headers: any, session: Session) => Promise<WebappAccessContext>;
+    requirePermission: (headers: any, session: Session, key: string) => Promise<WebappAccessContext>;
+    hasPermission: typeof hasPermissionInContext;
+    isSuperAdminEmail: (email: string | null | undefined) => boolean;
+};
+export type WebappRbac = ReturnType<typeof createWebappRbac>;
+export {};

package/dist/zauru/rbac/index.d.ts

@@ -0,0 +1,3 @@
+export { addPermissionKeys, allPermissionKeysFromGroups, DEFAULT_SUPER_ADMIN_EMAIL_SUFFIXES, flattenPermissionRows, isValidPermissionKey, normalizeIdList, normalizePermissionKeys, removePermissionKeys, togglePermissionKey, } from "./catalog.js";
+export { emptyAccessContext, hasPermission, hasPermissionKey, isActiveWebappRow, isSuperAdminEmail, } from "./access.js";
+export { createWebappRbac, type AssignEmployeeRoleInput, type CreateRoleInput, type UpdateRoleInput, type WebappRbac, } from "./createWebappRbac.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zauru-sdk/utils",
-  "version": "6.20.0",
+  "version": "6.22.0",
   "description": "Utilidades, parseo de request y demás para desarrollo de webapps de Zauru",
   "main": "./dist/esm/index.js",
   "module": "./dist/esm/index.js",
@@ -71,12 +71,12 @@
   "dependencies": {
     "@aws-sdk/client-cloudwatch-logs": "^3.1123.0",
     "@remix-run/node": "^2.8.1",
-    "@zauru-sdk/common": "^6.8.3",
+    "@zauru-sdk/common": "^6.8.5",
     "@zauru-sdk/config": "^6.0.0",
     "@zauru-sdk/graphql": "^6.8.0",
-    "@zauru-sdk/services": "^6.11.6",
-    "@zauru-sdk/types": "^6.21.0",
+    "@zauru-sdk/services": "^6.11.8",
+    "@zauru-sdk/types": "^6.23.0",
     "moment": "^2.30.1"
   },
-  "gitHead": "7d373b9f5c25ab0198e72590c661bc9eb17cf80f"
+  "gitHead": "a3c1f2af46acb59cf9fcb78ecb18d904e33c61e5"
 }