@zauru-sdk/utils 6.22.0 → 6.23.0

package/dist/esm/zauru/auth.loaders.js

@@ -1,6 +1,6 @@
 import { redirect } from "@remix-run/node";
 import { config } from "@zauru-sdk/config";
-import { commitSession, destroySession, getRefreshSession, getSession, loginWebApp, } from "@zauru-sdk/services";
+import { commitSession, destroySession, getHeaders, getRefreshSession, getSession, loginWebApp, } from "@zauru-sdk/services";
 const loginErrorPayload = (description, title) => ({
     error: true,
     type: "error",
@@ -9,6 +9,23 @@ const loginErrorPayload = (description, title) => ({
     description,
 });
 const isDenied = (result) => result === false;
+const isResponse = (value) => typeof Response !== "undefined" && value instanceof Response;
+const deniedLoginPayload = () => loginErrorPayload("No tienes permiso para acceder a esta aplicación. Si crees que esto es un error, contacta al administrador.", "Acceso denegado");
+const evaluateLoginAccess = async (extras, session, headers) => {
+    try {
+        if (isDenied(await extras?.requireAccess?.(session, headers))) {
+            return Response.json(deniedLoginPayload());
+        }
+        return null;
+    }
+    catch (error) {
+        if (isResponse(error)) {
+            throw error;
+        }
+        const description = error instanceof Error ? error.message : String(error);
+        return Response.json(loginErrorPayload(description));
+    }
+};
 const authorizeUrl = (request) => {
     const url = new URL(request.url);
     const hostname = `${url.port ? "http://" : "https://"}${url.hostname}${url.port ? `:${url.port}` : ""}`;
@@ -41,7 +58,16 @@ export function createLoginAction(extras) {
             return redirect(authorizeUrl(request));
         }
         if (session.has("code")) {
-            if (isDenied(await extras?.requireAccess?.(session))) {
+            const existingHeaders = await getHeaders(null, session);
+            try {
+                if (isDenied(await extras?.requireAccess?.(session, existingHeaders))) {
+                    return redirect("/");
+                }
+            }
+            catch (error) {
+                if (isResponse(error)) {
+                    throw error;
+                }
                 return redirect("/");
             }
             return redirect("/home");
@@ -50,8 +76,9 @@ export function createLoginAction(extras) {
         if (loginResponse.error || !loginResponse.data) {
             return Response.json(loginErrorPayload(loginResponse.userMsg?.toString() ?? ""));
         }
-        if (isDenied(await extras?.requireAccess?.(session))) {
-            return Response.json(loginErrorPayload("No tienes permiso para acceder a esta aplicación. Si crees que esto es un error, contacta al administrador.", "Acceso denegado"));
+        const denied = await evaluateLoginAccess(extras, session, loginResponse.data.headers);
+        if (denied) {
+            return denied;
         }
         if (extras?.afterLogin) {
             await extras.afterLogin({
@@ -78,7 +105,8 @@ export function createSessionGuardLoader(extras) {
         if (!session.has("username")) {
             return redirect("/");
         }
-        if (isDenied(await extras?.requireAccess?.(session))) {
+        const headers = await getHeaders(null, session);
+        if (isDenied(await extras?.requireAccess?.(session, headers))) {
             return redirect("/");
         }
         return Response.json({});
@@ -104,7 +132,8 @@ export function createIndexLoader(extras) {
     return async ({ request }) => {
         const session = await getSession(request.headers.get("Cookie"));
         if (session.has("username")) {
-            if (isDenied(await extras?.requireAccess?.(session))) {
+            const headers = await getHeaders(null, session);
+            if (isDenied(await extras?.requireAccess?.(session, headers))) {
                 return Response.json({});
             }
             return redirect("/home");
@@ -121,7 +150,8 @@ export function createReloadCatalogsLoader(extras) {
         if (!session.has("username")) {
             return redirect("/");
         }
-        if (isDenied(await extras?.requireAccess?.(session))) {
+        const headers = await getHeaders(null, session);
+        if (isDenied(await extras?.requireAccess?.(session, headers))) {
             return redirect("/");
         }
         try {

package/dist/esm/zauru/rbac/createWebappRbac.js

@@ -1,6 +1,6 @@
 import { redirect } from "@remix-run/node";
 import { handlePossibleAxiosErrors } from "@zauru-sdk/common";
-import { createWebAppTableRegister, getVariablesByName, getWebAppRow, getWebAppTableRegisters, updateWebAppTableRegister, } from "@zauru-sdk/services";
+import { createWebAppTableRegister, getHeaders, getVariablesByName, getWebAppRow, getWebAppTableRegisters, updateWebAppTableRegister, } from "@zauru-sdk/services";
 import { hasPermission as hasPermissionInContext, isActiveWebappRow, isSuperAdminEmail, } from "./access.js";
 import { DEFAULT_SUPER_ADMIN_EMAIL_SUFFIXES, isValidPermissionKey, normalizePermissionKeys, } from "./catalog.js";
 const deletedAt = () => new Date().toISOString();
@@ -11,11 +11,14 @@ const toNumber = (value) => {
 export function createWebappRbac(config) {
     const suffixes = config.superAdminEmailSuffixes ?? DEFAULT_SUPER_ADMIN_EMAIL_SUFFIXES;
     const validKeys = new Set(config.allPermissionKeys);
+    const resolveHeaders = async (headers, session) => {
+        if (headers?.["X-User-Token"] || headers?.["x-user-token"]) {
+            return headers;
+        }
+        return getHeaders(null, session);
+    };
     const getTableIds = async (headers, session) => {
-        const vars = await getVariablesByName(headers, session, [
-            config.rolesTableVar,
-            config.employeeRolesTableVar,
-        ]);
+        const vars = await getVariablesByName(await resolveHeaders(headers, session), session, [config.rolesTableVar, config.employeeRolesTableVar]);
         return {
             rolesTableId: vars[config.rolesTableVar],
             employeeRolesTableId: vars[config.employeeRolesTableVar],
@@ -210,6 +213,7 @@ export function createWebappRbac(config) {
         const context = await resolveAccess(headers, session);
         return context != null;
     };
+    const hasAppAccessFromSession = (session) => hasAppAccess(undefined, session);
     const requireAppAccess = async (headers, session) => {
         if (!session.has("username")) {
             throw redirect("/");
@@ -220,6 +224,7 @@ export function createWebappRbac(config) {
         }
         return context;
     };
+    const requireAppAccessFromSession = (session) => requireAppAccess(undefined, session);
     const requirePermission = async (headers, session, key) => {
         const context = await requireAppAccess(headers, session);
         if (!hasPermissionInContext(context, key)) {
@@ -240,7 +245,9 @@ export function createWebappRbac(config) {
         assignEmployeeRole,
         resolveAccess,
         hasAppAccess,
+        hasAppAccessFromSession,
         requireAppAccess,
+        requireAppAccessFromSession,
         requirePermission,
         hasPermission: hasPermissionInContext,
         isSuperAdminEmail: (email) => isSuperAdminEmail(email, suffixes),

package/dist/zauru/auth.loaders.d.ts

@@ -6,8 +6,12 @@ export type AuthAccessExtras = {
     /**
      * Return `false` to deny. Throw `redirect(...)` to send the user elsewhere.
      * Any other return (including `void`) allows access.
+     *
+     * `headers` is present after a successful `loginWebApp`; otherwise it is
+     * built from the session (`X-User-Email` / `X-User-Token`). Prefer
+     * `rbac.hasAppAccessFromSession` so callers do not pass `{}`.
      */
-    requireAccess?: (session: AuthSession) => boolean | void | Promise<boolean | void>;
+    requireAccess?: (session: AuthSession, headers?: Record<string, string>) => boolean | void | Promise<boolean | void>;
 };
 export type LoginActionExtras = AuthAccessExtras & {
     afterLogin?: (ctx: {

package/dist/zauru/rbac/createWebappRbac.d.ts

@@ -29,7 +29,9 @@ export declare function createWebappRbac(config: WebappRbacConfig): {
     assignEmployeeRole: (headers: any, session: Session, body: AssignEmployeeRoleInput) => Promise<AxiosUtilsResponse<WebAppTableUpdateResponse>>;
     resolveAccess: (headers: any, session: Session) => Promise<WebappAccessContext | null>;
     hasAppAccess: (headers: any, session: Session) => Promise<boolean>;
+    hasAppAccessFromSession: (session: Session) => Promise<boolean>;
     requireAppAccess: (headers: any, session: Session) => Promise<WebappAccessContext>;
+    requireAppAccessFromSession: (session: Session) => Promise<WebappAccessContext>;
     requirePermission: (headers: any, session: Session, key: string) => Promise<WebappAccessContext>;
     hasPermission: typeof hasPermissionInContext;
     isSuperAdminEmail: (email: string | null | undefined) => boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zauru-sdk/utils",
-  "version": "6.22.0",
+  "version": "6.23.0",
   "description": "Utilidades, parseo de request y demás para desarrollo de webapps de Zauru",
   "main": "./dist/esm/index.js",
   "module": "./dist/esm/index.js",
@@ -71,12 +71,12 @@
   "dependencies": {
     "@aws-sdk/client-cloudwatch-logs": "^3.1123.0",
     "@remix-run/node": "^2.8.1",
-    "@zauru-sdk/common": "^6.8.5",
+    "@zauru-sdk/common": "^6.8.6",
     "@zauru-sdk/config": "^6.0.0",
     "@zauru-sdk/graphql": "^6.8.0",
-    "@zauru-sdk/services": "^6.11.8",
-    "@zauru-sdk/types": "^6.23.0",
+    "@zauru-sdk/services": "^6.11.9",
+    "@zauru-sdk/types": "^6.24.0",
     "moment": "^2.30.1"
   },
-  "gitHead": "a3c1f2af46acb59cf9fcb78ecb18d904e33c61e5"
+  "gitHead": "7020f7ea3b89b2c07998a5f7eb8586452c0cdc28"
 }