arkos 2.0.0-next.2 → 2.0.0-next.21

package/dist/cjs/modules/auth/auth.service.js

@@ -1,277 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthService = void 0;
-const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
-const bcryptjs_1 = __importDefault(require("bcryptjs"));
-const catch_async_1 = __importDefault(require("../error-handler/utils/catch-async.js"));
-const app_error_1 = __importDefault(require("../error-handler/utils/app-error.js"));
-const base_middlewares_1 = require("../base/base.middlewares.js");
-const server_1 = require("../../server.js");
-const arkos_env_1 = __importDefault(require("../../utils/arkos-env.js"));
-const prisma_helpers_1 = require("../../utils/helpers/prisma.helpers.js");
-const auth_controller_helpers_1 = require("./utils/helpers/auth.controller.helpers.js");
-const auth_error_objects_1 = require("./utils/auth-error-objects.js");
-const auth_action_service_1 = __importDefault(require("./utils/services/auth-action.service.js"));
-const arkos_config_helpers_1 = require("../../utils/helpers/arkos-config.helpers.js");
-class AuthService {
-    constructor() {
-        this.actionsPerResource = {};
-        this.authenticate = (0, catch_async_1.default)(async (req, _, next) => {
-            if ((0, arkos_config_helpers_1.isAuthenticationEnabled)()) {
-                const user = (await this.getAuthenticatedUser(req));
-                if (!user)
-                    throw auth_error_objects_1.loginRequiredError;
-                req.user = user;
-            }
-            next();
-        });
-    }
-    signJwtToken(id, expiresIn, secret) {
-        const { authentication: configs } = (0, server_1.getArkosConfig)();
-        if (process.env.ARKOS_BUILD === "true" &&
-            !process.env.JWT_SECRET &&
-            !configs?.jwt?.secret)
-            throw new app_error_1.default("Missing JWT secret on production!", 500, "MissingJWTOnProduction");
-        secret =
-            secret ||
-                configs?.jwt?.secret ||
-                process.env.JWT_SECRET ||
-                arkos_env_1.default.JWT_SECRET;
-        expiresIn = (expiresIn ||
-            configs?.jwt?.expiresIn ||
-            process.env.JWT_EXPIRES_IN ||
-            arkos_env_1.default.JWT_EXPIRES_IN);
-        return jsonwebtoken_1.default.sign({ id }, secret, {
-            expiresIn: expiresIn,
-        });
-    }
-    getJwtCookieOptions(req) {
-        const arkosConfig = (0, server_1.getArkosConfig)();
-        const authConfigs = arkosConfig?.authentication;
-        if (!req)
-            throw new Error("Missing req object in order get jwt cookie options");
-        const sameSite = authConfigs?.jwt?.cookie?.sameSite ||
-            process.env.JWT_COOKIE_SAME_SITE ||
-            "lax";
-        return {
-            expires: new Date(Date.now() +
-                Number((0, auth_controller_helpers_1.toMs)(authConfigs?.jwt?.expiresIn ||
-                    process.env.JWT_EXPIRES_IN ||
-                    arkos_env_1.default.JWT_EXPIRES_IN))),
-            httpOnly: authConfigs?.jwt?.cookie?.httpOnly ??
-                (process.env.JWT_COOKIE_HTTP_ONLY !== undefined
-                    ? process.env.JWT_COOKIE_HTTP_ONLY === "true"
-                    : undefined) ??
-                true,
-            secure: (() => {
-                if (authConfigs?.jwt?.cookie?.secure !== undefined)
-                    return authConfigs?.jwt?.cookie?.secure;
-                else if (process.env.JWT_COOKIE_SECURE !== undefined)
-                    return process.env.JWT_COOKIE_SECURE === "true";
-                else
-                    return req.secure || req.headers["x-forwarded-proto"] === "https";
-            })(),
-            sameSite,
-        };
-    }
-    isPasswordHashed(password) {
-        return !Number.isNaN(bcryptjs_1.default.getRounds(password) * 1);
-    }
-    async isCorrectPassword(candidatePassword, userPassword) {
-        return await bcryptjs_1.default.compare(candidatePassword, userPassword);
-    }
-    async hashPassword(password) {
-        return await bcryptjs_1.default.hash(password, 12);
-    }
-    isPasswordStrong(password) {
-        const initAuthConfigs = (0, server_1.getArkosConfig)()?.authentication;
-        const strongPasswordRegex = initAuthConfigs?.passwordValidation?.regex ||
-            /^(?=.*[A-Z])(?=.*[a-z])(?=.*\d).+$/;
-        return strongPasswordRegex.test(password);
-    }
-    userChangedPasswordAfter(user, JWTTimestamp) {
-        if (user.passwordChangedAt) {
-            const convertedTimestamp = parseInt(String(user.passwordChangedAt.getTime() / 1000), 10);
-            return JWTTimestamp < convertedTimestamp;
-        }
-        return false;
-    }
-    async verifyJwtToken(token, secret) {
-        const { authentication: configs } = (0, server_1.getArkosConfig)();
-        if (process.env.ARKOS_BUILD === "true" &&
-            !process.env.JWT_SECRET &&
-            !configs?.jwt?.secret)
-            throw new app_error_1.default("Missing JWT secret in production", 500, "MissingJWTSecretInProduction");
-        secret =
-            secret ||
-                configs?.jwt?.secret ||
-                process.env.JWT_SECRET ||
-                arkos_env_1.default.JWT_SECRET;
-        return new Promise((resolve, reject) => {
-            jsonwebtoken_1.default.verify(token, secret, (err, decoded) => {
-                if (err)
-                    reject(err);
-                else
-                    resolve(decoded);
-            });
-        });
-    }
-    isWildcardAccess(config) {
-        return config === "*";
-    }
-    isRoleList(config) {
-        return Array.isArray(config);
-    }
-    isAccessRules(config) {
-        return (typeof config === "object" && config !== null && !Array.isArray(config));
-    }
-    normalizeRuleToRoles(rule) {
-        if (!rule)
-            return [];
-        if (rule === "*")
-            return ["*"];
-        if (Array.isArray(rule))
-            return rule;
-        return rule.roles === "*" ? ["*"] : (rule.roles ?? []);
-    }
-    resolveAuthorizedRoles(action, accessControl) {
-        if (this.isWildcardAccess(accessControl))
-            return ["*"];
-        if (this.isRoleList(accessControl))
-            return accessControl;
-        if (this.isAccessRules(accessControl))
-            return this.normalizeRuleToRoles(accessControl[action]);
-        return [];
-    }
-    checkStaticAccessControl(user, action, accessControl) {
-        if (!user?.role && !user.roles)
-            throw Error("Validation Error: In order to use static authentication user needs at least role field or roles for multiple roles.");
-        let authorizedRoles = this.resolveAuthorizedRoles(action, accessControl);
-        const userRoles = Array.isArray(user?.roles) ? user.roles : [user.role];
-        return (authorizedRoles?.[0] === "*" ||
-            !!userRoles.some((role) => authorizedRoles.includes(role)));
-    }
-    async checkDynamicAccessControl(userId, action, resource) {
-        const prisma = (0, prisma_helpers_1.getPrismaInstance)();
-        return !!(await prisma.userRole.findFirst({
-            where: {
-                userId,
-                role: {
-                    permissions: {
-                        some: {
-                            resource,
-                            action,
-                        },
-                    },
-                },
-            },
-            select: { id: true },
-        }));
-    }
-    handleAccessControl(action, resource, accessControl) {
-        auth_action_service_1.default.add(action, resource, accessControl);
-        return (0, catch_async_1.default)(async (req, _, next) => {
-            if (req.user) {
-                const user = req.user;
-                const configs = (0, server_1.getArkosConfig)();
-                if (user.isSuperUser) {
-                    next();
-                    return;
-                }
-                const notEnoughPermissionsError = new app_error_1.default("You do not have permission to perfom this action", 403, "NotEnoughPermissions");
-                if (configs?.authentication?.mode === "dynamic") {
-                    const hasPermission = await this.checkDynamicAccessControl(user.id, action, resource);
-                    if (!hasPermission)
-                        return next(notEnoughPermissionsError);
-                }
-                else if (configs?.authentication?.mode === "static") {
-                    if (!accessControl)
-                        return next(notEnoughPermissionsError);
-                    const hasPermission = this.checkStaticAccessControl(user, action, accessControl);
-                    if (!hasPermission)
-                        return next(notEnoughPermissionsError);
-                }
-            }
-            next();
-        });
-    }
-    async getAuthenticatedUser(req) {
-        if (!(0, arkos_config_helpers_1.isAuthenticationEnabled)())
-            throw Error("ValidationError: Trying to call AuthService.getAuthenticatedUser without setting up authentication");
-        const prisma = (0, prisma_helpers_1.getPrismaInstance)();
-        let token;
-        if (req?.headers?.authorization &&
-            req?.headers?.authorization.startsWith("Bearer") &&
-            req?.headers?.authorization.split?.(" ")?.[1])
-            token = req?.headers?.authorization.split(" ")[1];
-        if (!token &&
-            req?.cookies?.arkos_access_token !== "no-token" &&
-            req.cookies) {
-            token = req?.cookies?.arkos_access_token;
-        }
-        if (!token)
-            return null;
-        let decoded;
-        try {
-            decoded = await this.verifyJwtToken(token);
-        }
-        catch (err) {
-            throw auth_error_objects_1.invaliAuthTokenError;
-        }
-        if (!decoded?.id)
-            throw auth_error_objects_1.invaliAuthTokenError;
-        const user = await prisma.user.findUnique({
-            where: { id: String(decoded.id) },
-        });
-        if (!user)
-            throw new app_error_1.default("The user belonging to this token does no longer exists", 401, "UserNoLongerExists");
-        if (this.userChangedPasswordAfter(user, decoded.iat) &&
-            !req.path?.includes?.("logout"))
-            throw new app_error_1.default("User recently changed password! Please log in again.", 401, "PasswordChanged");
-        req.accessToken = token;
-        return user;
-    }
-    handleAuthenticationControl(action, authenticationControl) {
-        if (authenticationControl && typeof authenticationControl === "object") {
-            if (authenticationControl[action] === false)
-                return base_middlewares_1.callNext;
-            else if (authenticationControl[action] === true)
-                return this.authenticate;
-        }
-        else
-            return this.authenticate;
-        return this.authenticate;
-    }
-    permission(action, resource, accessControl) {
-        const stack = new Error().stack;
-        if (stack?.includes("node_modules/express/lib/router/index.js"))
-            throw new Error("authService.permission() should be called during application initialization level.");
-        auth_action_service_1.default.add(action, resource, accessControl);
-        return async (user) => {
-            const configs = (0, server_1.getArkosConfig)();
-            if (!(0, arkos_config_helpers_1.isUsingAuthentication)())
-                throw Error("Validation Error: Trying to use authService.permission without setting up authentication.");
-            if (!(0, arkos_config_helpers_1.isAuthenticationEnabled)())
-                return false;
-            if (!user)
-                throw auth_error_objects_1.loginRequiredError;
-            if (user?.isSuperUser)
-                return true;
-            if (configs?.authentication?.mode === "dynamic") {
-                return await this.checkDynamicAccessControl(user?.id, action, resource);
-            }
-            else if (configs?.authentication?.mode === "static") {
-                return (!!accessControl &&
-                    this.checkStaticAccessControl(user, action, accessControl));
-            }
-            return false;
-        };
-    }
-}
-exports.AuthService = AuthService;
-const authService = new AuthService();
-exports.default = authService;
-//# sourceMappingURL=auth.service.js.map

package/dist/cjs/modules/auth/auth.service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":";;;;;;AAAA,gEAAgD;AAChD,wDAA8B;AAE9B,qFAA4D;AAC5D,iFAAwD;AACxD,+DAAoD;AACpD,yCAA8C;AAC9C,sEAA6C;AAC7C,uEAAuE;AAevE,qFAA2E;AAC3E,mEAGoC;AACpC,+FAAqE;AACrE,mFAGkD;AAKlD,MAAa,WAAW;IAAxB;QAIE,uBAAkB,GAAgC,EAAE,CAAC;QA2crD,iBAAY,GAAG,IAAA,qBAAU,EACvB,KAAK,EAAE,GAAiB,EAAE,CAAgB,EAAE,IAAuB,EAAE,EAAE;YACrE,IAAI,IAAA,8CAAuB,GAAE,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAS,CAAC;gBAC5D,IAAI,CAAC,IAAI;oBAAE,MAAM,uCAAkB,CAAC;gBACpC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAClB,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC,CACF,CAAC;IAmFJ,CAAC;IA7hBC,YAAY,CACV,EAAmB,EACnB,SAA+B,EAC/B,MAAe;QAEf,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,IAAA,uBAAc,GAAE,CAAC;QAErD,IACE,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM;YAClC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU;YACvB,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM;YAErB,MAAM,IAAI,mBAAQ,CAChB,mCAAmC,EACnC,GAAG,EACH,wBAAwB,CACzB,CAAC;QAEJ,MAAM;YACJ,MAAM;gBACN,OAAO,EAAE,GAAG,EAAE,MAAM;gBACpB,OAAO,CAAC,GAAG,CAAC,UAAU;gBACtB,mBAAQ,CAAC,UAAU,CAAC;QAEtB,SAAS,GAAG,CAAC,SAAS;YACpB,OAAO,EAAE,GAAG,EAAE,SAAS;YACvB,OAAO,CAAC,GAAG,CAAC,cAAc;YAC1B,mBAAQ,CAAC,cAAc,CAAmC,CAAC;QAE7D,OAAO,sBAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YAC9B,SAAS,EAAE,SAAuB;SACnC,CAAC,CAAC;IACL,CAAC;IAoBD,mBAAmB,CAAC,GAAiB;QACnC,MAAM,WAAW,GAAG,IAAA,uBAAc,GAAE,CAAC;QACrC,MAAM,WAAW,GAAG,WAAW,EAAE,cAAc,CAAC;QAEhD,IAAI,CAAC,GAAG;YACN,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAExE,MAAM,QAAQ,GACZ,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ;YACjC,OAAO,CAAC,GAAG,CAAC,oBAIC;YACd,KAAK,CAAC;QAER,OAAO;YACL,OAAO,EAAE,IAAI,IAAI,CACf,IAAI,CAAC,GAAG,EAAE;gBACR,MAAM,CACJ,IAAA,8BAAI,EACF,WAAW,EAAE,GAAG,EAAE,SAAS;oBACxB,OAAO,CAAC,GAAG,CAAC,cAA6B;oBACzC,mBAAQ,CAAC,cAA6B,CAC1C,CACF,CACJ;YACD,QAAQ,EACN,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ;gBAClC,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,SAAS;oBAC7C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,MAAM;oBAC7C,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI;YACN,MAAM,EAAE,CAAC,GAAG,EAAE;gBACZ,IAAI,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,KAAK,SAAS;oBAChD,OAAO,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC;qBACrC,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,SAAS;oBAClD,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,MAAM,CAAC;;oBAC7C,OAAO,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,OAAO,CAAC;YACzE,CAAC,CAAC,EAAE;YACJ,QAAQ;SACT,CAAC;IACJ,CAAC;IAaD,gBAAgB,CAAC,QAAgB;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;IASD,KAAK,CAAC,iBAAiB,CACrB,iBAAyB,EACzB,YAAoB;QAEpB,OAAO,MAAM,kBAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;IAC/D,CAAC;IAQD,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,OAAO,MAAM,kBAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC;IAmBM,gBAAgB,CAAC,QAAgB;QACtC,MAAM,eAAe,GAAG,IAAA,uBAAc,GAAE,EAAE,cAAc,CAAC;QAEzD,MAAM,mBAAmB,GACvB,eAAe,EAAE,kBAAkB,EAAE,KAAK;YAC1C,oCAAoC,CAAC;QACvC,OAAO,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IASD,wBAAwB,CAAC,IAAU,EAAE,YAAoB;QACvD,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,kBAAkB,GAAG,QAAQ,CACjC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EAC/C,EAAE,CACH,CAAC;YAEF,OAAO,YAAY,GAAG,kBAAkB,CAAC;QAC3C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAUD,KAAK,CAAC,cAAc,CAClB,KAAa,EACb,MAAe;QAEf,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,IAAA,uBAAc,GAAE,CAAC;QAErD,IACE,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM;YAClC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU;YACvB,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM;YAErB,MAAM,IAAI,mBAAQ,CAChB,kCAAkC,EAClC,GAAG,EACH,8BAA8B,CAC/B,CAAC;QAEJ,MAAM;YACJ,MAAM;gBACN,OAAO,EAAE,GAAG,EAAE,MAAM;gBACpB,OAAO,CAAC,GAAG,CAAC,UAAU;gBACtB,mBAAQ,CAAC,UAAU,CAAC;QAEtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;gBACzC,IAAI,GAAG;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;oBAChB,OAAO,CAAC,OAAyB,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,MAA2B;QAClD,OAAO,MAAM,KAAK,GAAG,CAAC;IACxB,CAAC;IAEO,UAAU,CAAC,MAA2B;QAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAEO,aAAa,CACnB,MAA2B;QAE3B,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CACxE,CAAC;IACJ,CAAC;IAEO,oBAAoB,CAC1B,IAA4D;QAE5D,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QACrB,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAEO,sBAAsB,CAC5B,MAAoB,EACpB,aAAkC;QAElC,IAAI,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,OAAO,aAAa,CAAC;QACzD,IAAI,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC;YACnC,OAAO,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,OAAO,EAAE,CAAC;IACZ,CAAC;IAYS,wBAAwB,CAChC,IAAU,EACV,MAAc,EACd,aAAkC;QAElC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK;YAC5B,MAAM,KAAK,CACT,qHAAqH,CACtH,CAAC;QAEJ,IAAI,eAAe,GAAG,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAEzE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAExE,OAAO,CACL,eAAe,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG;YAC5B,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CACnE,CAAC;IACJ,CAAC;IAWS,KAAK,CAAC,yBAAyB,CACvC,MAAc,EACd,MAAc,EACd,QAAgB;QAEhB,MAAM,MAAM,GAAG,IAAA,kCAAiB,GAAE,CAAC;QACnC,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACxC,KAAK,EAAE;gBACL,MAAM;gBACN,IAAI,EAAE;oBACJ,WAAW,EAAE;wBACX,IAAI,EAAE;4BACJ,QAAQ;4BACR,MAAM;yBACP;qBACF;iBACF;aACF;YACD,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC,CAAC,CAAC;IACN,CAAC;IAUD,mBAAmB,CACjB,MAAoB,EACpB,QAAgB,EAChB,aAAmC;QAEnC,6BAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;QAEvD,OAAO,IAAA,qBAAU,EACf,KAAK,EAAE,GAAiB,EAAE,CAAgB,EAAE,IAAuB,EAAE,EAAE;YACrE,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,GAAG,CAAC,IAAY,CAAC;gBAC9B,MAAM,OAAO,GAAG,IAAA,uBAAc,GAAE,CAAC;gBAEjC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;oBACrB,IAAI,EAAE,CAAC;oBACP,OAAO;gBACT,CAAC;gBAED,MAAM,yBAAyB,GAAG,IAAI,mBAAQ,CAC5C,kDAAkD,EAClD,GAAG,EACH,sBAAsB,CACvB,CAAC;gBAEF,IAAI,OAAO,EAAE,cAAc,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;oBAChD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,yBAAyB,CACxD,IAAI,CAAC,EAAE,EACP,MAAM,EACN,QAAQ,CACT,CAAC;oBAEF,IAAI,CAAC,aAAa;wBAAE,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;gBAC7D,CAAC;qBAAM,IAAI,OAAO,EAAE,cAAc,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtD,IAAI,CAAC,aAAa;wBAAE,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;oBAE3D,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CACjD,IAAI,EACJ,MAAM,EACN,aAAa,CACd,CAAC;oBAEF,IAAI,CAAC,aAAa;wBAAE,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;gBAC7D,CAAC;YACH,CAAC;YAED,IAAI,EAAE,CAAC;QACT,CAAC,CACF,CAAC;IACJ,CAAC;IAQD,KAAK,CAAC,oBAAoB,CAAC,GAAiB;QAC1C,IAAI,CAAC,IAAA,8CAAuB,GAAE;YAC5B,MAAM,KAAK,CACT,oGAAoG,CACrG,CAAC;QAEJ,MAAM,MAAM,GAAG,IAAA,kCAAiB,GAAE,CAAC;QAEnC,IAAI,KAAyB,CAAC;QAE9B,IACE,GAAG,EAAE,OAAO,EAAE,aAAa;YAC3B,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC;YAChD,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAE7C,KAAK,GAAG,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEpD,IACE,CAAC,KAAK;YACN,GAAG,EAAE,OAAO,EAAE,kBAAkB,KAAK,UAAU;YAC/C,GAAG,CAAC,OAAO,EACX,CAAC;YACD,KAAK,GAAG,GAAG,EAAE,OAAO,EAAE,kBAAkB,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,OAAmC,CAAC;QAExC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,yCAAoB,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,EAAE;YAAE,MAAM,yCAAoB,CAAC;QAC7C,MAAM,IAAI,GAAe,MAAO,MAAc,CAAC,IAAI,CAAC,UAAU,CAAC;YAC7D,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE;SAClC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,mBAAQ,CAChB,wDAAwD,EACxD,GAAG,EACH,oBAAoB,CACrB,CAAC;QAEJ,IACE,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,GAAI,CAAC;YACjD,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC;YAE/B,MAAM,IAAI,mBAAQ,CAChB,sDAAsD,EACtD,GAAG,EACH,iBAAiB,CAClB,CAAC;QAEJ,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IA4BD,2BAA2B,CACzB,MAAoB,EACpB,qBAA+D;QAE/D,IAAI,qBAAqB,IAAI,OAAO,qBAAqB,KAAK,QAAQ,EAAE,CAAC;YACvE,IAAI,qBAAqB,CAAC,MAAM,CAAC,KAAK,KAAK;gBAAE,OAAO,2BAAQ,CAAC;iBACxD,IAAI,qBAAqB,CAAC,MAAM,CAAC,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC,YAAY,CAAC;QAC5E,CAAC;;YAAM,OAAO,IAAI,CAAC,YAAY,CAAC;QAEhC,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAyBD,UAAU,CACR,MAAc,EACd,QAAgB,EAChB,aAAmC;QAGnC,MAAM,KAAK,GAAG,IAAI,KAAK,EAAE,CAAC,KAAK,CAAC;QAEhC,IAAI,KAAK,EAAE,QAAQ,CAAC,0CAA0C,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;QAEJ,6BAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;QAEvD,OAAO,KAAK,EAAE,IAAsB,EAAoB,EAAE;YAExD,MAAM,OAAO,GAAG,IAAA,uBAAc,GAAE,CAAC;YAEjC,IAAI,CAAC,IAAA,4CAAqB,GAAE;gBAC1B,MAAM,KAAK,CACT,2FAA2F,CAC5F,CAAC;YAEJ,IAAI,CAAC,IAAA,8CAAuB,GAAE;gBAAE,OAAO,KAAK,CAAC;YAC7C,IAAI,CAAC,IAAI;gBAAE,MAAM,uCAAkB,CAAC;YACpC,IAAI,IAAI,EAAE,WAAW;gBAAE,OAAO,IAAI,CAAC;YAEnC,IAAI,OAAO,EAAE,cAAc,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBAChD,OAAO,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC1E,CAAC;iBAAM,IAAI,OAAO,EAAE,cAAc,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtD,OAAO,CACL,CAAC,CAAC,aAAa;oBACf,IAAI,CAAC,wBAAwB,CAAC,IAAW,EAAE,MAAM,EAAE,aAAa,CAAC,CAClE,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;IACJ,CAAC;CACF;AA3iBD,kCA2iBC;AAKD,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AAEtC,kBAAe,WAAW,CAAC","sourcesContent":["import jwt, { SignOptions } from \"jsonwebtoken\";\nimport bcrypt from \"bcryptjs\";\nimport { User } from \"../../types\";\nimport catchAsync from \"../error-handler/utils/catch-async\";\nimport AppError from \"../error-handler/utils/app-error\";\nimport { callNext } from \"../base/base.middlewares\";\nimport { getArkosConfig } from \"../../server\";\nimport arkosEnv from \"../../utils/arkos-env\";\nimport { getPrismaInstance } from \"../../utils/helpers/prisma.helpers\";\nimport {\n  ArkosRequest,\n  ArkosResponse,\n  ArkosNextFunction,\n  ArkosRequestHandler,\n} from \"../../types\";\nimport {\n  AuthJwtPayload,\n  AccessAction,\n  AccessControlConfig,\n  AuthenticationControlConfig,\n  AccessControlRules,\n  DetailedAccessControlRule,\n} from \"../../types/auth\";\nimport { MsDuration, toMs } from \"./utils/helpers/auth.controller.helpers\";\nimport {\n  invaliAuthTokenError,\n  loginRequiredError,\n} from \"./utils/auth-error-objects\";\nimport authActionService from \"./utils/services/auth-action.service\";\nimport {\n  isAuthenticationEnabled,\n  isUsingAuthentication,\n} from \"../../utils/helpers/arkos-config.helpers\";\n\n/**\n * Handles various authentication-related tasks such as JWT signing, password hashing, and verifying user credentials.\n */\nexport class AuthService {\n  /**\n   * Object containing a combination of actions per resource, tracked by each set of calls of `authService.handleAccessControl`, this can be accessed through the `authService` object or through the endpoint\n   */\n  actionsPerResource: Record<string, Set<string>> = {};\n\n  /**\n   * Signs a JWT token for the user.\n   *\n   * @param {number | string} id - The unique identifier of the user to generate the token for.\n   * @param {string | number} [expiresIn] - The expiration time for the token. Defaults to environment variable `JWT_EXPIRES_IN`.\n   * @param {string} [secret] - The secret key used to sign the token. Defaults to environment variable `JWT_SECRET`.\n   * @returns {string} The signed JWT token.\n   */\n  signJwtToken(\n    id: number | string,\n    expiresIn?: MsDuration | number,\n    secret?: string\n  ): string {\n    const { authentication: configs } = getArkosConfig();\n\n    if (\n      process.env.ARKOS_BUILD === \"true\" &&\n      !process.env.JWT_SECRET &&\n      !configs?.jwt?.secret\n    )\n      throw new AppError(\n        \"Missing JWT secret on production!\",\n        500,\n        \"MissingJWTOnProduction\"\n      );\n\n    secret =\n      secret ||\n      configs?.jwt?.secret ||\n      process.env.JWT_SECRET ||\n      arkosEnv.JWT_SECRET;\n\n    expiresIn = (expiresIn ||\n      configs?.jwt?.expiresIn ||\n      process.env.JWT_EXPIRES_IN ||\n      arkosEnv.JWT_EXPIRES_IN) as keyof SignOptions[\"expiresIn\"];\n\n    return jwt.sign({ id }, secret, {\n      expiresIn: expiresIn as MsDuration,\n    });\n  }\n\n  /**\n   * Retrieves cookie configuration options for JWT authentication.\n   *\n   * Merges configuration from multiple sources in order of precedence:\n   * 1. Arkos configuration file\n   * 2. Environment variables\n   * 3. Request properties (for secure flag)\n   * 4. Default fallback values\n   *\n   * @param req - ArkosRequest object used to determine if the connection is secure\n   * @returns Cookie options object with expires, httpOnly, secure, and sameSite properties\n   *\n   * @example\n   * ```typescript\n   * const cookieOptions = authService.getJwtCookieOptions(req);\n   * res.cookie('jwt', token, cookieOptions);\n   * ```\n   */\n  getJwtCookieOptions(req: ArkosRequest) {\n    const arkosConfig = getArkosConfig();\n    const authConfigs = arkosConfig?.authentication;\n\n    if (!req)\n      throw new Error(\"Missing req object in order get jwt cookie options\");\n\n    const sameSite =\n      authConfigs?.jwt?.cookie?.sameSite ||\n      (process.env.JWT_COOKIE_SAME_SITE as\n        | \"none\"\n        | \"lax\"\n        | \"strict\"\n        | undefined) ||\n      \"lax\";\n\n    return {\n      expires: new Date(\n        Date.now() +\n          Number(\n            toMs(\n              authConfigs?.jwt?.expiresIn ||\n                (process.env.JWT_EXPIRES_IN as MsDuration) ||\n                (arkosEnv.JWT_EXPIRES_IN as MsDuration)\n            )\n          )\n      ),\n      httpOnly:\n        authConfigs?.jwt?.cookie?.httpOnly ??\n        (process.env.JWT_COOKIE_HTTP_ONLY !== undefined\n          ? process.env.JWT_COOKIE_HTTP_ONLY === \"true\"\n          : undefined) ??\n        true,\n      secure: (() => {\n        if (authConfigs?.jwt?.cookie?.secure !== undefined)\n          return authConfigs?.jwt?.cookie?.secure;\n        else if (process.env.JWT_COOKIE_SECURE !== undefined)\n          return process.env.JWT_COOKIE_SECURE === \"true\";\n        else return req.secure || req.headers[\"x-forwarded-proto\"] === \"https\";\n      })(),\n      sameSite,\n    };\n  }\n\n  /**\n   * Is used by default internally by Arkos under `BaseService` class to check if the password is already hashed.\n   *\n   * This was just added to prevent unwanted errors when someone just forgets that the `BaseService` class will automatically hash the password field using `authService.hashPassword` by default.\n   *\n   * So now before `BaseService` hashes it will test it.\n   *\n   *\n   * @param password The password to be tested if is hashed\n   * @returns\n   */\n  isPasswordHashed(password: string) {\n    return !Number.isNaN(bcrypt.getRounds(password) * 1);\n  }\n\n  /**\n   * Compares a candidate password with the stored user password to check if they match.\n   *\n   * @param {string} candidatePassword - The password provided by the user during login.\n   * @param {string} userPassword - The password stored in the database.\n   * @returns {Promise<boolean>} Returns true if the passwords match, otherwise false.\n   */\n  async isCorrectPassword(\n    candidatePassword: string,\n    userPassword: string\n  ): Promise<boolean> {\n    return await bcrypt.compare(candidatePassword, userPassword);\n  }\n\n  /**\n   * Hashes a plain text password using bcrypt.\n   *\n   * @param {string} password - The password to be hashed.\n   * @returns {Promise<string>} Returns the hashed password.\n   */\n  async hashPassword(password: string): Promise<string> {\n    return await bcrypt.hash(password, 12);\n  }\n\n  /**\n   * Checks if a password is strong, requiring uppercase, lowercase, and numeric characters as the default.\n   *\n   * **NB**: You must pay attention when using custom validation with zod or class-validator, try to use the same regex always.\n   *\n   * **Note**: You can define it when calling arkos.init()\n   * ```ts\n   * arkos.init({\n   *  authentication: {\n   *    passwordValidation:{ regex: /your-desired-regex/, message: 'password must contain...'}\n   *  }\n   * })\n   * ```\n   *\n   * @param {string} password - The password to check.\n   * @returns {boolean} Returns true if the password meets the strength criteria, otherwise false.\n   */\n  public isPasswordStrong(password: string): boolean {\n    const initAuthConfigs = getArkosConfig()?.authentication;\n\n    const strongPasswordRegex =\n      initAuthConfigs?.passwordValidation?.regex ||\n      /^(?=.*[A-Z])(?=.*[a-z])(?=.*\\d).+$/;\n    return strongPasswordRegex.test(password);\n  }\n\n  /**\n   * Checks if a user has changed their password after the JWT was issued.\n   *\n   * @param {User} user - The user object containing the passwordChangedAt field.\n   * @param {number} JWTTimestamp - The timestamp when the JWT was issued.\n   * @returns {boolean} Returns true if the user changed their password after the JWT was issued, otherwise false.\n   */\n  userChangedPasswordAfter(user: User, JWTTimestamp: number): boolean {\n    if (user.passwordChangedAt) {\n      const convertedTimestamp = parseInt(\n        String(user.passwordChangedAt.getTime() / 1000),\n        10\n      );\n\n      return JWTTimestamp < convertedTimestamp;\n    }\n    return false;\n  }\n\n  /**\n   * Verifies the authenticity of a JWT token.\n   *\n   * @param {string} token - The JWT token to verify.\n   * @param {string} [secret] - The secret key used to verify the token. Defaults to environment variable `JWT_SECRET`.\n   * @returns {Promise<AuthJwtPayload>} Returns the decoded JWT payload if the token is valid.\n   * @throws {Error} Throws an error if the token is invalid or expired.\n   */\n  async verifyJwtToken(\n    token: string,\n    secret?: string\n  ): Promise<AuthJwtPayload> {\n    const { authentication: configs } = getArkosConfig();\n\n    if (\n      process.env.ARKOS_BUILD === \"true\" &&\n      !process.env.JWT_SECRET &&\n      !configs?.jwt?.secret\n    )\n      throw new AppError(\n        \"Missing JWT secret in production\",\n        500,\n        \"MissingJWTSecretInProduction\"\n      );\n\n    secret =\n      secret ||\n      configs?.jwt?.secret ||\n      process.env.JWT_SECRET ||\n      arkosEnv.JWT_SECRET;\n\n    return new Promise((resolve, reject) => {\n      jwt.verify(token, secret, (err, decoded) => {\n        if (err) reject(err);\n        else resolve(decoded as AuthJwtPayload);\n      });\n    });\n  }\n\n  private isWildcardAccess(config: AccessControlConfig): config is \"*\" {\n    return config === \"*\";\n  }\n\n  private isRoleList(config: AccessControlConfig): config is string[] {\n    return Array.isArray(config);\n  }\n\n  private isAccessRules(\n    config: AccessControlConfig\n  ): config is Partial<AccessControlRules> {\n    return (\n      typeof config === \"object\" && config !== null && !Array.isArray(config)\n    );\n  }\n\n  private normalizeRuleToRoles(\n    rule: string[] | DetailedAccessControlRule | \"*\" | undefined\n  ): string[] {\n    if (!rule) return [];\n    if (rule === \"*\") return [\"*\"];\n    if (Array.isArray(rule)) return rule;\n    return rule.roles === \"*\" ? [\"*\"] : (rule.roles ?? []);\n  }\n\n  private resolveAuthorizedRoles(\n    action: AccessAction,\n    accessControl: AccessControlConfig\n  ): string[] {\n    if (this.isWildcardAccess(accessControl)) return [\"*\"];\n    if (this.isRoleList(accessControl)) return accessControl;\n    if (this.isAccessRules(accessControl))\n      return this.normalizeRuleToRoles(accessControl[action]);\n    return [];\n  }\n\n  /**\n   * Checks if a user has permission for a specific action using static access control rules.\n   * Validates user roles against predefined access control configuration.\n   *\n   * @param user - The user object containing role or roles field\n   * @param action - The action being performed\n   * @param accessControl - Access control configuration (array of roles or object with action-role mappings)\n   * @returns True if user has permission, false otherwise\n   * @throws Error if user doesn't have role/roles field\n   */\n  protected checkStaticAccessControl(\n    user: User,\n    action: string,\n    accessControl: AccessControlConfig\n  ) {\n    if (!user?.role && !user.roles)\n      throw Error(\n        \"Validation Error: In order to use static authentication user needs at least role field or roles for multiple roles.\"\n      );\n\n    let authorizedRoles = this.resolveAuthorizedRoles(action, accessControl);\n\n    const userRoles = Array.isArray(user?.roles) ? user.roles : [user.role];\n\n    return (\n      authorizedRoles?.[0] === \"*\" ||\n      !!userRoles.some((role: string) => authorizedRoles.includes(role))\n    );\n  }\n\n  /**\n   * Checks if a user has permission for a specific action and resource using dynamic access control.\n   * Queries the database to verify user's role permissions.\n   *\n   * @param userId - The unique identifier of the user\n   * @param action - The action being performed\n   * @param resource - The resource being accessed\n   * @returns Promise resolving to true if user has permission, false otherwise\n   */\n  protected async checkDynamicAccessControl(\n    userId: string,\n    action: string,\n    resource: string\n  ) {\n    const prisma = getPrismaInstance();\n    return !!(await prisma.userRole.findFirst({\n      where: {\n        userId,\n        role: {\n          permissions: {\n            some: {\n              resource,\n              action,\n            },\n          },\n        },\n      },\n      select: { id: true },\n    }));\n  }\n\n  /**\n   * Middleware function to handle access control based on user roles and permissions.\n   *\n   * @param {AccessAction} action - The action being performed (e.g., create, update, delete, view).\n   * @param {string} resource - The resource name that the action is being performed on (e.g., \"User\", \"Post\").\n   * @param {AccessControlConfig} accessControl - The access control configuration.\n   * @returns {ArkosRequestHandler} The middleware function that checks if the user has permission to perform the action.\n   */\n  handleAccessControl(\n    action: AccessAction,\n    resource: string,\n    accessControl?: AccessControlConfig\n  ): ArkosRequestHandler {\n    authActionService.add(action, resource, accessControl);\n\n    return catchAsync(\n      async (req: ArkosRequest, _: ArkosResponse, next: ArkosNextFunction) => {\n        if (req.user) {\n          const user = req.user as User;\n          const configs = getArkosConfig();\n\n          if (user.isSuperUser) {\n            next();\n            return;\n          }\n\n          const notEnoughPermissionsError = new AppError(\n            \"You do not have permission to perfom this action\",\n            403,\n            \"NotEnoughPermissions\"\n          );\n\n          if (configs?.authentication?.mode === \"dynamic\") {\n            const hasPermission = await this.checkDynamicAccessControl(\n              user.id,\n              action,\n              resource\n            );\n\n            if (!hasPermission) return next(notEnoughPermissionsError);\n          } else if (configs?.authentication?.mode === \"static\") {\n            if (!accessControl) return next(notEnoughPermissionsError);\n\n            const hasPermission = this.checkStaticAccessControl(\n              user,\n              action,\n              accessControl\n            );\n\n            if (!hasPermission) return next(notEnoughPermissionsError);\n          }\n        }\n\n        next();\n      }\n    );\n  }\n\n  /**\n   * Processes the cookies or authoriation token and returns the user.\n   * @param req\n   * @returns {Promise<User | null>} - if authentication is turned off in arkosConfig it returns null\n   * @throws {AppError} Throws an error if the token is invalid or the user is not logged in.\n   */\n  async getAuthenticatedUser(req: ArkosRequest): Promise<User | null> {\n    if (!isAuthenticationEnabled())\n      throw Error(\n        \"ValidationError: Trying to call AuthService.getAuthenticatedUser without setting up authentication\"\n      );\n\n    const prisma = getPrismaInstance();\n\n    let token: string | undefined;\n\n    if (\n      req?.headers?.authorization &&\n      req?.headers?.authorization.startsWith(\"Bearer\") &&\n      req?.headers?.authorization.split?.(\" \")?.[1]\n    )\n      token = req?.headers?.authorization.split(\" \")[1];\n\n    if (\n      !token &&\n      req?.cookies?.arkos_access_token !== \"no-token\" &&\n      req.cookies\n    ) {\n      token = req?.cookies?.arkos_access_token;\n    }\n\n    if (!token) return null;\n\n    let decoded: AuthJwtPayload | undefined;\n\n    try {\n      decoded = await this.verifyJwtToken(token);\n    } catch (err) {\n      throw invaliAuthTokenError;\n    }\n\n    if (!decoded?.id) throw invaliAuthTokenError;\n    const user: any | null = await (prisma as any).user.findUnique({\n      where: { id: String(decoded.id) },\n    });\n\n    if (!user)\n      throw new AppError(\n        \"The user belonging to this token does no longer exists\",\n        401,\n        \"UserNoLongerExists\"\n      );\n\n    if (\n      this.userChangedPasswordAfter(user, decoded.iat!) &&\n      !req.path?.includes?.(\"logout\")\n    )\n      throw new AppError(\n        \"User recently changed password! Please log in again.\",\n        401,\n        \"PasswordChanged\"\n      );\n\n    req.accessToken = token;\n    return user;\n  }\n\n  /**\n   * Middleware function to authenticate the user based on the JWT token.\n   *\n   * @param {ArkosRequest} req - The request object.\n   * @param {ArkosResponse} res - The response object.\n   * @param {ArkosNextFunction} next - The next middleware function to be called.\n   * @returns {void}\n   */\n  authenticate = catchAsync(\n    async (req: ArkosRequest, _: ArkosResponse, next: ArkosNextFunction) => {\n      if (isAuthenticationEnabled()) {\n        const user = (await this.getAuthenticatedUser(req)) as User;\n        if (!user) throw loginRequiredError;\n        req.user = user;\n      }\n      next();\n    }\n  );\n\n  /**\n   * Handles authentication control by checking the `authenticationControl` configuration in the `authConfigs`.\n   *\n   * @param {ControllerActions} action - The action being performed (e.g., create, update, delete, view).\n   * @param {AuthenticationControlConfig} authenticationControl - The authentication configuration object.\n   * @returns {ArkosRequestHandler} The middleware function that checks if authentication is required.\n   */\n  handleAuthenticationControl(\n    action: AccessAction,\n    authenticationControl?: AuthenticationControlConfig | undefined\n  ): ArkosRequestHandler {\n    if (authenticationControl && typeof authenticationControl === \"object\") {\n      if (authenticationControl[action] === false) return callNext;\n      else if (authenticationControl[action] === true) return this.authenticate;\n    } else return this.authenticate;\n\n    return this.authenticate;\n  }\n\n  /**\n   * Creates a permission checker function for a specific action and resource.\n   *\n   * PS: This method should be called during application initialization to build permission validators.\n   *\n   * @see {@link https://www.arkosjs.com/docs/advanced-guide/fine-grained-access-control}\n   *\n   * @param action - The action to check permission for (e.g., 'View', 'Create', 'Delete')\n   * @param resource - The resource being accessed, must be in kebabCase (e.g., 'user', 'cart-item', 'order')\n   * @param accessControl - Access control rules (required for static authentication mode), and it is automatically loaded for known modules such as all prisma models, auth and file-upload.\n   * @returns A function that takes a user object and returns a boolean indicating permission status\n   *\n   * @example\n   * ```typescript\n   * const hasViewProductPermission = await authService.permission('View', 'product');\n   *\n   * // Later in handler:\n   * const canAccess = await hasViewProductPermission(user);\n   * if (canAccess) {\n   *   // User has permission\n   * }\n   * ```\n   */\n  permission(\n    action: string,\n    resource: string,\n    accessControl?: AccessControlConfig\n  ) {\n    // Check if called during request handling (deep call stack indicates handler execution)\n    const stack = new Error().stack;\n\n    if (stack?.includes(\"node_modules/express/lib/router/index.js\"))\n      throw new Error(\n        \"authService.permission() should be called during application initialization level.\"\n      );\n\n    authActionService.add(action, resource, accessControl);\n\n    return async (user: User | undefined): Promise<boolean> => {\n      // getArkosConfig must not be called the same time as arkos.init()\n      const configs = getArkosConfig();\n\n      if (!isUsingAuthentication())\n        throw Error(\n          \"Validation Error: Trying to use authService.permission without setting up authentication.\"\n        );\n\n      if (!isAuthenticationEnabled()) return false;\n      if (!user) throw loginRequiredError;\n      if (user?.isSuperUser) return true;\n\n      if (configs?.authentication?.mode === \"dynamic\") {\n        return await this.checkDynamicAccessControl(user?.id, action, resource);\n      } else if (configs?.authentication?.mode === \"static\") {\n        return (\n          !!accessControl &&\n          this.checkStaticAccessControl(user as any, action, accessControl)\n        );\n      }\n      return false;\n    };\n  }\n}\n\n/**\n * Handles various authentication-related tasks such as JWT signing, password hashing, and verifying user credentials.\n */\nconst authService = new AuthService();\n\nexport default authService;\n"]}

package/dist/cjs/modules/auth/utils/auth-error-objects.js

@@ -1,10 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.invaliAuthTokenError = exports.loginRequiredError = void 0;
-const app_error_1 = __importDefault(require("../../error-handler/utils/app-error.js"));
-exports.loginRequiredError = new app_error_1.default("You are not logged in! please log in to get access", 401, {}, "LoginRequired");
-exports.invaliAuthTokenError = new app_error_1.default("Your auth token is invalid, please login again.", 401, {}, "InvalidAuthToken");
-//# sourceMappingURL=auth-error-objects.js.map

package/dist/cjs/modules/auth/utils/auth-error-objects.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-error-objects.js","sourceRoot":"","sources":["../../../../../src/modules/auth/utils/auth-error-objects.ts"],"names":[],"mappings":";;;;;;AAAA,oFAA2D;AAE9C,QAAA,kBAAkB,GAAG,IAAI,mBAAQ,CAC5C,oDAAoD,EACpD,GAAG,EACH,EAAE,EACF,eAAe,CAChB,CAAC;AAEW,QAAA,oBAAoB,GAAG,IAAI,mBAAQ,CAC9C,iDAAiD,EACjD,GAAG,EACH,EAAE,EACF,kBAAkB,CACnB,CAAC","sourcesContent":["import AppError from \"../../error-handler/utils/app-error\";\n\nexport const loginRequiredError = new AppError(\n  \"You are not logged in! please log in to get access\",\n  401,\n  {},\n  \"LoginRequired\"\n);\n\nexport const invaliAuthTokenError = new AppError(\n  \"Your auth token is invalid, please login again.\",\n  401,\n  {},\n  \"InvalidAuthToken\"\n);\n"]}

package/dist/cjs/modules/auth/utils/helpers/auth.controller.helpers.js

@@ -1,83 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.getNestedValue = exports.createPrismaWhereClause = exports.determineUsernameField = void 0;
-exports.toMs = toMs;
-const server_1 = require("../../../../server.js");
-const app_error_1 = __importDefault(require("../../../error-handler/utils/app-error.js"));
-const determineUsernameField = (req) => {
-    const authConfigs = (0, server_1.getArkosConfig)()?.authentication;
-    if (req.query?.usernameField &&
-        typeof req.query?.usernameField === "string" &&
-        authConfigs?.login?.allowedUsernames?.includes?.(req.query.usernameField))
-        return req.query.usernameField;
-    else if (req.query?.usernameField)
-        throw new app_error_1.default("Invalid usernameField parameter, it is not allowed!", 400);
-    return authConfigs?.login?.allowedUsernames?.[0] || "username";
-};
-exports.determineUsernameField = determineUsernameField;
-const createPrismaWhereClause = (path, value) => {
-    if (!path)
-        return {};
-    const parts = path.split(".");
-    const whereClause = {};
-    if (parts.length === 1) {
-        whereClause[parts[0]] = value;
-        return whereClause;
-    }
-    let current = whereClause;
-    for (let i = 0; i < parts.length - 1; i++) {
-        const part = parts[i];
-        current[part] = {};
-        current = current[part];
-    }
-    current[parts[parts.length - 1]] = value;
-    return whereClause;
-};
-exports.createPrismaWhereClause = createPrismaWhereClause;
-const getNestedValue = (obj, path) => {
-    if (!obj || !path)
-        return undefined;
-    const properties = path.split(".");
-    const lastProperty = properties[properties.length - 1];
-    if (lastProperty in obj) {
-        return obj[lastProperty];
-    }
-    return undefined;
-};
-exports.getNestedValue = getNestedValue;
-function normalizeDuration(input) {
-    return input
-        .toLowerCase()
-        .replace(/years?|yr|year/g, "y")
-        .replace(/minutes?|min/g, "m")
-        .replace(/seconds?|sec|secs/g, "s")
-        .replace(/hours?|hr/g, "h")
-        .replace(/days?/g, "d")
-        .replace(/weeks?/g, "w")
-        .replace(/milliseconds?/g, "ms");
-}
-function toMs(input) {
-    if (typeof input === "number")
-        return input * 1000;
-    const normalizedInput = normalizeDuration(input.trim());
-    const regex = /^(\d+(?:\.\d+)?)(ms|s|m|h|d|w|y)$/i;
-    const match = normalizedInput.match(regex);
-    if (!match)
-        throw new Error(`Invalid time format: ${input}`);
-    const value = parseFloat(match[1]);
-    const unit = match[2].toLowerCase();
-    const multipliers = {
-        ms: 1,
-        s: 1000,
-        m: 60000,
-        h: 3600000,
-        d: 86400000,
-        w: 604800000,
-        y: 31557600000,
-    };
-    return value * multipliers[unit];
-}
-//# sourceMappingURL=auth.controller.helpers.js.map

package/dist/cjs/modules/auth/utils/helpers/auth.controller.helpers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.controller.helpers.js","sourceRoot":"","sources":["../../../../../../src/modules/auth/utils/helpers/auth.controller.helpers.ts"],"names":[],"mappings":";;;;;;AAuHA,oBAkCC;AAzJD,+CAAoD;AAEpD,uFAA8D;AAcvD,MAAM,sBAAsB,GAAG,CAAC,GAAiB,EAAU,EAAE;IAClE,MAAM,WAAW,GAAG,IAAA,uBAAc,GAAE,EAAE,cAAc,CAAC;IAErD,IACE,GAAG,CAAC,KAAK,EAAE,aAAa;QACxB,OAAO,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,QAAQ;QAC5C,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC;QAEzE,OAAO,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC;SAC5B,IAAI,GAAG,CAAC,KAAK,EAAE,aAAa;QAC/B,MAAM,IAAI,mBAAQ,CAChB,qDAAqD,EACrD,GAAG,CACJ,CAAC;IAEJ,OAAO,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC;AACjE,CAAC,CAAC;AAhBW,QAAA,sBAAsB,0BAgBjC;AAWK,MAAM,uBAAuB,GAAG,CACrC,IAAY,EACZ,KAAU,EACW,EAAE;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAErB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,WAAW,GAAwB,EAAE,CAAC;IAG5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;QAC9B,OAAO,WAAW,CAAC;IACrB,CAAC;IAGD,IAAI,OAAO,GAAG,WAAW,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACnB,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;IAEzC,OAAO,WAAW,CAAC;AACrB,CAAC,CAAC;AA1BW,QAAA,uBAAuB,2BA0BlC;AAWK,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAE,IAAY,EAAO,EAAE;IAC5D,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAEpC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAGvD,IAAI,YAAY,IAAI,GAAG,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAZW,QAAA,cAAc,kBAYzB;AAeF,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK;SACT,WAAW,EAAE;SACb,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC;SAC/B,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;SAC7B,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC;SAClC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC;SAC1B,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,SAAgB,IAAI,CAAC,KAA0B;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,GAAG,IAAI,CAAC;IAGnD,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAGxD,MAAM,KAAK,GAAG,oCAAoC,CAAC;IACnD,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAE3C,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAC;IAE7D,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAO1B,CAAC;IAER,MAAM,WAAW,GACf;QACE,EAAE,EAAE,CAAC;QACL,CAAC,EAAE,IAAI;QACP,CAAC,EAAE,KAAK;QACR,CAAC,EAAE,OAAO;QACV,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,SAAS;QACZ,CAAC,EAAE,WAAW;KACf,CAAC;IAEJ,OAAO,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC","sourcesContent":["import { getArkosConfig } from \"../../../../server\";\nimport { ArkosRequest } from \"../../../../types\";\nimport AppError from \"../../../error-handler/utils/app-error\";\n\n/**\n * Determines the username field to use for authentication and supports nested paths\n * Priority:\n * 1. req.query.usernameField\n * 2. config setting\n * 3. default \"username\"\n *\n * Supports dot notation for nested fields and array queries (e.g., \"profile.nickname\", \"phones.some.number\")\n *\n * @param req - The request object\n * @returns The field name to use for username identification\n */\nexport const determineUsernameField = (req: ArkosRequest): string => {\n  const authConfigs = getArkosConfig()?.authentication;\n\n  if (\n    req.query?.usernameField &&\n    typeof req.query?.usernameField === \"string\" &&\n    authConfigs?.login?.allowedUsernames?.includes?.(req.query.usernameField)\n  )\n    return req.query.usernameField;\n  else if (req.query?.usernameField)\n    throw new AppError(\n      \"Invalid usernameField parameter, it is not allowed!\",\n      400\n    );\n\n  return authConfigs?.login?.allowedUsernames?.[0] || \"username\";\n};\n\n/**\n * Creates a Prisma-compatible where clause from a path using dot notation\n * Handles nested objects and array queries with \"some\" operator\n * Example: createPrismaWhereClause(\"profile.nickname\", \"john\") or createPrismaWhereClause(\"phones.some.number\", \"1234567890\")\n *\n * @param path - The dot notation path (e.g., \"profile.nickname\" or \"phones.some.number\")\n * @param value - The value to search for\n * @returns A nested object suitable for Prisma's where clause\n */\nexport const createPrismaWhereClause = (\n  path: string,\n  value: any\n): Record<string, any> => {\n  if (!path) return {};\n\n  const parts = path.split(\".\");\n  const whereClause: Record<string, any> = {};\n\n  // Handle simple field case\n  if (parts.length === 1) {\n    whereClause[parts[0]] = value;\n    return whereClause;\n  }\n\n  // Handle nested fields\n  let current = whereClause;\n  for (let i = 0; i < parts.length - 1; i++) {\n    const part = parts[i];\n    current[part] = {};\n    current = current[part];\n  }\n\n  current[parts[parts.length - 1]] = value;\n\n  return whereClause;\n};\n\n/**\n * Access a value from a simple object based on a dot notation path\n * The object will only contain a single property that matches the last part of the path\n * Example: getNestedValue({nickname: \"john\"}, \"profile.nickname\") => \"john\"\n *\n * @param obj - The object containing the value (simple key-value pair)\n * @param path - The dot notation path (only the last part is used to access the object)\n * @returns The value from the object if the key matches the last part of the path, or undefined\n */\nexport const getNestedValue = (obj: any, path: string): any => {\n  if (!obj || !path) return undefined;\n\n  const properties = path.split(\".\");\n  const lastProperty = properties[properties.length - 1];\n\n  // If the last property exists in the object, return its value\n  if (lastProperty in obj) {\n    return obj[lastProperty];\n  }\n\n  return undefined;\n};\n\n/**\n * MsDuration type allows specific units for durations\n *\n * **For example**: 90d, 10ms, 50s.\n *\n * **Available metrics**: ms, s, m, h, d, w, y.\n * */\nexport type MsDuration =\n  | number\n  | `${number}`\n  | `${number}${\"ms\" | \"s\" | \"m\" | \"h\" | \"d\" | \"w\" | \"y\"}`; // Short format (e.g., \"1y\")\n\n// Normalize function to convert long units to short ones\nfunction normalizeDuration(input: string): string {\n  return input\n    .toLowerCase()\n    .replace(/years?|yr|year/g, \"y\")\n    .replace(/minutes?|min/g, \"m\")\n    .replace(/seconds?|sec|secs/g, \"s\")\n    .replace(/hours?|hr/g, \"h\")\n    .replace(/days?/g, \"d\")\n    .replace(/weeks?/g, \"w\")\n    .replace(/milliseconds?/g, \"ms\");\n}\n\nexport function toMs(input: number | MsDuration): number {\n  if (typeof input === \"number\") return input * 1000; // If it's a number, assume it's in seconds\n\n  // Normalize the string input\n  const normalizedInput = normalizeDuration(input.trim());\n\n  // Type assertion: we assert that normalizedInput will now match the MsDuration format\n  const regex = /^(\\d+(?:\\.\\d+)?)(ms|s|m|h|d|w|y)$/i;\n  const match = normalizedInput.match(regex);\n\n  if (!match) throw new Error(`Invalid time format: ${input}`);\n\n  const value = parseFloat(match[1]);\n  const unit = match[2].toLowerCase() as\n    | \"ms\"\n    | \"s\"\n    | \"m\"\n    | \"h\"\n    | \"d\"\n    | \"w\"\n    | \"y\";\n\n  const multipliers: Record<\"ms\" | \"s\" | \"m\" | \"h\" | \"d\" | \"w\" | \"y\", number> =\n    {\n      ms: 1,\n      s: 1000,\n      m: 60000,\n      h: 3600000,\n      d: 86400000,\n      w: 604800000,\n      y: 31557600000, // 365.25 days in ms\n    };\n\n  return value * multipliers[unit];\n}\n"]}

package/dist/cjs/modules/auth/utils/services/auth-action.service.js

@@ -1,150 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const utils_1 = require("../../../../exports/utils/index.js");
-const arkos_config_helpers_1 = require("../../../../utils/helpers/arkos-config.helpers.js");
-const text_helpers_1 = require("../../../../utils/helpers/text.helpers.js");
-class AuthActionService {
-    constructor() {
-        this.authActions = [
-            {
-                roles: [],
-                action: "View",
-                resource: "auth-action",
-                name: "View auth action",
-                description: "View an auth action",
-                errorMessage: "You do not have permission to perform this operation",
-            },
-        ];
-    }
-    add(action, resource, accessControl) {
-        const transformedAction = this.transformAccessControlToValidAuthAction(action, resource, accessControl);
-        const existingAuthAction = this.getOne(action, resource);
-        if (existingAuthAction) {
-            const inconsistencies = [];
-            const defaultName = `${(0, text_helpers_1.capitalize)((0, utils_1.kebabCase)(action).replace(/-/g, " "))} ${(0, text_helpers_1.capitalize)((0, utils_1.kebabCase)(resource).replace(/-/g, " "))}`;
-            const defaultDescription = `${(0, text_helpers_1.capitalize)((0, utils_1.kebabCase)(action).replace(/-/g, " "))} ${(0, text_helpers_1.capitalize)((0, utils_1.kebabCase)(resource).replace(/-/g, " "))}`;
-            const defaultErrorMessage = "You do not have permission to perform this operation";
-            const isNonDefault = (value, defaultValue) => {
-                return value !== undefined && value !== defaultValue;
-            };
-            if (isNonDefault(existingAuthAction.name, defaultName) &&
-                isNonDefault(transformedAction.name, defaultName) &&
-                existingAuthAction.name !== transformedAction.name) {
-                inconsistencies.push(`  - name: "${existingAuthAction.name}" vs "${transformedAction.name}"`);
-            }
-            if (isNonDefault(existingAuthAction.description, defaultDescription) &&
-                isNonDefault(transformedAction.description, defaultDescription) &&
-                existingAuthAction.description !== transformedAction.description) {
-                inconsistencies.push(`  - description: "${existingAuthAction.description}" vs "${transformedAction.description}"`);
-            }
-            if (isNonDefault(existingAuthAction.errorMessage, defaultErrorMessage) &&
-                isNonDefault(transformedAction.errorMessage, defaultErrorMessage) &&
-                existingAuthAction.errorMessage !== transformedAction.errorMessage) {
-                inconsistencies.push(`  - errorMessage: "${existingAuthAction.errorMessage}" vs "${transformedAction.errorMessage}"`);
-            }
-            if (inconsistencies.length > 0) {
-                throw new Error(`Inconsistent metadata for permission "${action}:${resource}". ` +
-                    `The same action+resource combination is being defined with different values:\n` +
-                    inconsistencies.join("\n") +
-                    `\n\nPlease ensure all definitions of "${action}:${resource}" have the same name, description, and errorMessage values.`);
-            }
-            const mergedRoles = existingAuthAction.roles || transformedAction.roles
-                ? [
-                    ...(existingAuthAction.roles || []),
-                    ...(transformedAction.roles || []),
-                ]
-                : undefined;
-            const uniqueRoles = mergedRoles
-                ? [...new Set(mergedRoles)].sort()
-                : undefined;
-            const merged = {
-                action: existingAuthAction.action,
-                resource: existingAuthAction.resource,
-                roles: uniqueRoles,
-                name: existingAuthAction.name ?? transformedAction.name,
-                description: existingAuthAction.description ?? transformedAction.description,
-                errorMessage: existingAuthAction.errorMessage ?? transformedAction.errorMessage,
-            };
-            this.remove(action, resource);
-            this.authActions.push(merged);
-        }
-        else {
-            if (transformedAction.roles) {
-                transformedAction.roles = [...transformedAction.roles].sort();
-            }
-            this.authActions.push(transformedAction);
-        }
-    }
-    remove(action, resource) {
-        this.authActions = this.authActions.filter((authAction) => !(authAction.action === action && authAction.resource === resource));
-    }
-    getAll() {
-        return this.authActions;
-    }
-    getOne(action, resource) {
-        return this.authActions.find((authAction) => authAction.action === action && authAction.resource === resource);
-    }
-    transformAccessControlToValidAuthAction(action, resource, accessControl) {
-        const baseAuthAction = {
-            roles: (accessControl &&
-                (Array.isArray(accessControl)
-                    ? accessControl
-                    : typeof accessControl === "string"
-                        ? [accessControl]
-                        : Array.isArray(accessControl?.[action] || {})
-                            ? accessControl[action]
-                            : accessControl[action]
-                                ?.roles)) ||
-                [],
-            action,
-            resource,
-            name: `${(0, text_helpers_1.capitalize)((0, utils_1.kebabCase)(action).replace(/-/g, " "))} ${(0, text_helpers_1.capitalize)((0, utils_1.kebabCase)(resource).replace(/-/g, " "))}`,
-            description: `${(0, text_helpers_1.capitalize)((0, utils_1.kebabCase)(action).replace(/-/g, " "))} ${(0, text_helpers_1.capitalize)((0, utils_1.kebabCase)(resource).replace(/-/g, " "))}`,
-            errorMessage: `You do not have permission to perform this operation`,
-        };
-        const config = (0, arkos_config_helpers_1.getArkosConfig)();
-        if (config?.authentication?.mode === "dynamic")
-            delete baseAuthAction.roles;
-        if (!accessControl)
-            return baseAuthAction;
-        if (Array.isArray(accessControl))
-            return baseAuthAction;
-        const actionRule = accessControl !== "*" ? accessControl[action] : undefined;
-        if (actionRule) {
-            if (Array.isArray(actionRule)) {
-                return baseAuthAction;
-            }
-            else if (typeof actionRule === "object") {
-                return {
-                    ...baseAuthAction,
-                    name: actionRule.name || baseAuthAction.name,
-                    description: actionRule?.description || baseAuthAction.description,
-                    errorMessage: actionRule?.errorMessage || baseAuthAction.errorMessage,
-                };
-            }
-        }
-        return baseAuthAction;
-    }
-    getUniqueActions() {
-        return [
-            ...new Set(this.authActions.map((authAction) => authAction.action)),
-        ];
-    }
-    getUniqueResources() {
-        return [
-            ...new Set(this.authActions.map((authAction) => authAction.resource)),
-        ];
-    }
-    getByResource(resource) {
-        return this.authActions.filter((authAction) => authAction.resource === resource);
-    }
-    getByAction(action) {
-        return this.authActions.filter((authAction) => authAction.action === action);
-    }
-    exists(action, resource) {
-        return !!this.getOne(action, resource);
-    }
-}
-const authActionService = new AuthActionService();
-exports.default = authActionService;
-//# sourceMappingURL=auth-action.service.js.map

package/dist/cjs/modules/auth/utils/services/auth-action.service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-action.service.js","sourceRoot":"","sources":["../../../../../../src/modules/auth/utils/services/auth-action.service.ts"],"names":[],"mappings":";;AAAA,qDAAsD;AAKtD,yFAAgF;AAChF,yEAAoE;AAWpE,MAAM,iBAAiB;IAAvB;QACE,gBAAW,GAAiB;YAC1B;gBACE,KAAK,EAAE,EAAE;gBACT,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,aAAa;gBACvB,IAAI,EAAE,kBAAkB;gBACxB,WAAW,EAAE,qBAAqB;gBAClC,YAAY,EAAE,sDAAsD;aACrE;SACF,CAAC;IAgMJ,CAAC;IA9LC,GAAG,CAAC,MAAc,EAAE,QAAgB,EAAE,aAAmC;QACvE,MAAM,iBAAiB,GAAG,IAAI,CAAC,uCAAuC,CACpE,MAAM,EACN,QAAQ,EACR,aAAa,CACd,CAAC;QACF,MAAM,kBAAkB,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEzD,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,eAAe,GAAa,EAAE,CAAC;YAErC,MAAM,WAAW,GAAG,GAAG,IAAA,yBAAU,EAAC,IAAA,iBAAS,EAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,IAAA,yBAAU,EAAC,IAAA,iBAAS,EAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAChI,MAAM,kBAAkB,GAAG,GAAG,IAAA,yBAAU,EAAC,IAAA,iBAAS,EAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,IAAA,yBAAU,EAAC,IAAA,iBAAS,EAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YACvI,MAAM,mBAAmB,GACvB,sDAAsD,CAAC;YAEzD,MAAM,YAAY,GAAG,CACnB,KAAyB,EACzB,YAAoB,EACX,EAAE;gBACX,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,YAAY,CAAC;YACvD,CAAC,CAAC;YAEF,IACE,YAAY,CAAC,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC;gBAClD,YAAY,CAAC,iBAAiB,CAAC,IAAI,EAAE,WAAW,CAAC;gBACjD,kBAAkB,CAAC,IAAI,KAAK,iBAAiB,CAAC,IAAI,EAClD,CAAC;gBACD,eAAe,CAAC,IAAI,CAClB,cAAc,kBAAkB,CAAC,IAAI,SAAS,iBAAiB,CAAC,IAAI,GAAG,CACxE,CAAC;YACJ,CAAC;YAED,IACE,YAAY,CAAC,kBAAkB,CAAC,WAAW,EAAE,kBAAkB,CAAC;gBAChE,YAAY,CAAC,iBAAiB,CAAC,WAAW,EAAE,kBAAkB,CAAC;gBAC/D,kBAAkB,CAAC,WAAW,KAAK,iBAAiB,CAAC,WAAW,EAChE,CAAC;gBACD,eAAe,CAAC,IAAI,CAClB,qBAAqB,kBAAkB,CAAC,WAAW,SAAS,iBAAiB,CAAC,WAAW,GAAG,CAC7F,CAAC;YACJ,CAAC;YAED,IACE,YAAY,CAAC,kBAAkB,CAAC,YAAY,EAAE,mBAAmB,CAAC;gBAClE,YAAY,CAAC,iBAAiB,CAAC,YAAY,EAAE,mBAAmB,CAAC;gBACjE,kBAAkB,CAAC,YAAY,KAAK,iBAAiB,CAAC,YAAY,EAClE,CAAC;gBACD,eAAe,CAAC,IAAI,CAClB,sBAAsB,kBAAkB,CAAC,YAAY,SAAS,iBAAiB,CAAC,YAAY,GAAG,CAChG,CAAC;YACJ,CAAC;YACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CACb,yCAAyC,MAAM,IAAI,QAAQ,KAAK;oBAC9D,gFAAgF;oBAChF,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC1B,yCAAyC,MAAM,IAAI,QAAQ,6DAA6D,CAC3H,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GACf,kBAAkB,CAAC,KAAK,IAAI,iBAAiB,CAAC,KAAK;gBACjD,CAAC,CAAC;oBACE,GAAG,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE,CAAC;oBACnC,GAAG,CAAC,iBAAiB,CAAC,KAAK,IAAI,EAAE,CAAC;iBACnC;gBACH,CAAC,CAAC,SAAS,CAAC;YAEhB,MAAM,WAAW,GAAG,WAAW;gBAC7B,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE;gBAClC,CAAC,CAAC,SAAS,CAAC;YAEd,MAAM,MAAM,GAAe;gBACzB,MAAM,EAAE,kBAAkB,CAAC,MAAM;gBACjC,QAAQ,EAAE,kBAAkB,CAAC,QAAQ;gBACrC,KAAK,EAAE,WAAW;gBAClB,IAAI,EAAE,kBAAkB,CAAC,IAAI,IAAI,iBAAiB,CAAC,IAAI;gBACvD,WAAW,EACT,kBAAkB,CAAC,WAAW,IAAI,iBAAiB,CAAC,WAAW;gBACjE,YAAY,EACV,kBAAkB,CAAC,YAAY,IAAI,iBAAiB,CAAC,YAAY;aACpE,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC9B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,IAAI,iBAAiB,CAAC,KAAK,EAAE,CAAC;gBAC5B,iBAAiB,CAAC,KAAK,GAAG,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,QAAgB;QACrC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CACxC,CAAC,UAAU,EAAE,EAAE,CACb,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,CACtE,CAAC;IACJ,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,QAAgB;QACrC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAC1B,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,CACnE,CAAC;IACJ,CAAC;IAEO,uCAAuC,CAC7C,MAAc,EACd,QAAgB,EAChB,aAAmC;QAEnC,MAAM,cAAc,GAAe;YACjC,KAAK,EACH,CAAC,aAAa;gBACZ,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;oBAC3B,CAAC,CAAC,aAAa;oBACf,CAAC,CAAC,OAAO,aAAa,KAAK,QAAQ;wBACjC,CAAC,CAAC,CAAC,aAAa,CAAC;wBACjB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;4BAC5C,CAAC,CAAE,aAAa,CAAC,MAAM,CAAc;4BACrC,CAAC,CAAE,aAAa,CAAC,MAAM,CAA+B;gCAClD,EAAE,KAAK,CAAC,CAAC;gBACrB,EAAE;YACJ,MAAM;YACN,QAAQ;YACR,IAAI,EAAE,GAAG,IAAA,yBAAU,EAAC,IAAA,iBAAS,EAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,IAAA,yBAAU,EAAC,IAAA,iBAAS,EAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE;YACjH,WAAW,EAAE,GAAG,IAAA,yBAAU,EAAC,IAAA,iBAAS,EAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,IAAA,yBAAU,EAAC,IAAA,iBAAS,EAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE;YACxH,YAAY,EAAE,sDAAsD;SACrE,CAAC;QAEF,MAAM,MAAM,GAAG,IAAA,qCAAc,GAAE,CAAC;QAEhC,IAAI,MAAM,EAAE,cAAc,EAAE,IAAI,KAAK,SAAS;YAAE,OAAO,cAAc,CAAC,KAAK,CAAC;QAE5E,IAAI,CAAC,aAAa;YAAE,OAAO,cAAc,CAAC;QAE1C,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;YAAE,OAAO,cAAc,CAAC;QAExD,MAAM,UAAU,GACd,aAAa,KAAK,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE5D,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,OAAO,cAAc,CAAC;YACxB,CAAC;iBAAM,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;gBAC1C,OAAO;oBACL,GAAG,cAAc;oBACjB,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI;oBAC5C,WAAW,EAAE,UAAU,EAAE,WAAW,IAAI,cAAc,CAAC,WAAW;oBAClE,YAAY,EAAE,UAAU,EAAE,YAAY,IAAI,cAAc,CAAC,YAAY;iBACtE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,gBAAgB;QACd,OAAO;YACL,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACpE,CAAC;IACJ,CAAC;IAED,kBAAkB;QAChB,OAAO;YACL,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;SACtE,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,QAAgB;QAC5B,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAC5B,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ,CACjD,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,MAAc;QACxB,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAC5B,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,KAAK,MAAM,CAC7C,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,QAAgB;QACrC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;CACF;AAED,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,EAAE,CAAC;AAElD,kBAAe,iBAAiB,CAAC","sourcesContent":["import { kebabCase } from \"../../../../exports/utils\";\nimport {\n  AccessControlConfig,\n  DetailedAccessControlRule,\n} from \"../../../../types/auth\";\nimport { getArkosConfig } from \"../../../../utils/helpers/arkos-config.helpers\";\nimport { capitalize } from \"../../../../utils/helpers/text.helpers\";\n\ninterface AuthAction {\n  roles?: string[] | \"*\";\n  action: string;\n  resource: string;\n  name?: string;\n  description?: string;\n  errorMessage?: string;\n}\n\nclass AuthActionService {\n  authActions: AuthAction[] = [\n    {\n      roles: [],\n      action: \"View\",\n      resource: \"auth-action\",\n      name: \"View auth action\",\n      description: \"View an auth action\",\n      errorMessage: \"You do not have permission to perform this operation\",\n    },\n  ];\n\n  add(action: string, resource: string, accessControl?: AccessControlConfig) {\n    const transformedAction = this.transformAccessControlToValidAuthAction(\n      action,\n      resource,\n      accessControl\n    );\n    const existingAuthAction = this.getOne(action, resource);\n\n    if (existingAuthAction) {\n      const inconsistencies: string[] = [];\n\n      const defaultName = `${capitalize(kebabCase(action).replace(/-/g, \" \"))} ${capitalize(kebabCase(resource).replace(/-/g, \" \"))}`;\n      const defaultDescription = `${capitalize(kebabCase(action).replace(/-/g, \" \"))} ${capitalize(kebabCase(resource).replace(/-/g, \" \"))}`;\n      const defaultErrorMessage =\n        \"You do not have permission to perform this operation\";\n\n      const isNonDefault = (\n        value: string | undefined,\n        defaultValue: string\n      ): boolean => {\n        return value !== undefined && value !== defaultValue;\n      };\n\n      if (\n        isNonDefault(existingAuthAction.name, defaultName) &&\n        isNonDefault(transformedAction.name, defaultName) &&\n        existingAuthAction.name !== transformedAction.name\n      ) {\n        inconsistencies.push(\n          `  - name: \"${existingAuthAction.name}\" vs \"${transformedAction.name}\"`\n        );\n      }\n\n      if (\n        isNonDefault(existingAuthAction.description, defaultDescription) &&\n        isNonDefault(transformedAction.description, defaultDescription) &&\n        existingAuthAction.description !== transformedAction.description\n      ) {\n        inconsistencies.push(\n          `  - description: \"${existingAuthAction.description}\" vs \"${transformedAction.description}\"`\n        );\n      }\n\n      if (\n        isNonDefault(existingAuthAction.errorMessage, defaultErrorMessage) &&\n        isNonDefault(transformedAction.errorMessage, defaultErrorMessage) &&\n        existingAuthAction.errorMessage !== transformedAction.errorMessage\n      ) {\n        inconsistencies.push(\n          `  - errorMessage: \"${existingAuthAction.errorMessage}\" vs \"${transformedAction.errorMessage}\"`\n        );\n      }\n      if (inconsistencies.length > 0) {\n        throw new Error(\n          `Inconsistent metadata for permission \"${action}:${resource}\". ` +\n            `The same action+resource combination is being defined with different values:\\n` +\n            inconsistencies.join(\"\\n\") +\n            `\\n\\nPlease ensure all definitions of \"${action}:${resource}\" have the same name, description, and errorMessage values.`\n        );\n      }\n\n      const mergedRoles =\n        existingAuthAction.roles || transformedAction.roles\n          ? [\n              ...(existingAuthAction.roles || []),\n              ...(transformedAction.roles || []),\n            ]\n          : undefined;\n\n      const uniqueRoles = mergedRoles\n        ? [...new Set(mergedRoles)].sort()\n        : undefined;\n\n      const merged: AuthAction = {\n        action: existingAuthAction.action,\n        resource: existingAuthAction.resource,\n        roles: uniqueRoles,\n        name: existingAuthAction.name ?? transformedAction.name,\n        description:\n          existingAuthAction.description ?? transformedAction.description,\n        errorMessage:\n          existingAuthAction.errorMessage ?? transformedAction.errorMessage,\n      };\n\n      this.remove(action, resource);\n      this.authActions.push(merged);\n    } else {\n      if (transformedAction.roles) {\n        transformedAction.roles = [...transformedAction.roles].sort();\n      }\n      this.authActions.push(transformedAction);\n    }\n  }\n\n  remove(action: string, resource: string) {\n    this.authActions = this.authActions.filter(\n      (authAction) =>\n        !(authAction.action === action && authAction.resource === resource)\n    );\n  }\n\n  getAll(): AuthAction[] {\n    return this.authActions;\n  }\n\n  getOne(action: string, resource: string): AuthAction | undefined {\n    return this.authActions.find(\n      (authAction) =>\n        authAction.action === action && authAction.resource === resource\n    );\n  }\n\n  private transformAccessControlToValidAuthAction(\n    action: string,\n    resource: string,\n    accessControl?: AccessControlConfig\n  ): AuthAction {\n    const baseAuthAction: AuthAction = {\n      roles:\n        (accessControl &&\n          (Array.isArray(accessControl)\n            ? accessControl\n            : typeof accessControl === \"string\"\n              ? [accessControl]\n              : Array.isArray(accessControl?.[action] || {})\n                ? (accessControl[action] as string[])\n                : (accessControl[action] as DetailedAccessControlRule)\n                    ?.roles)) ||\n        [],\n      action,\n      resource,\n      name: `${capitalize(kebabCase(action).replace(/-/g, \" \"))} ${capitalize(kebabCase(resource).replace(/-/g, \" \"))}`,\n      description: `${capitalize(kebabCase(action).replace(/-/g, \" \"))} ${capitalize(kebabCase(resource).replace(/-/g, \" \"))}`,\n      errorMessage: `You do not have permission to perform this operation`,\n    };\n\n    const config = getArkosConfig();\n\n    if (config?.authentication?.mode === \"dynamic\") delete baseAuthAction.roles;\n\n    if (!accessControl) return baseAuthAction;\n\n    if (Array.isArray(accessControl)) return baseAuthAction;\n\n    const actionRule =\n      accessControl !== \"*\" ? accessControl[action] : undefined;\n\n    if (actionRule) {\n      if (Array.isArray(actionRule)) {\n        return baseAuthAction;\n      } else if (typeof actionRule === \"object\") {\n        return {\n          ...baseAuthAction,\n          name: actionRule.name || baseAuthAction.name,\n          description: actionRule?.description || baseAuthAction.description,\n          errorMessage: actionRule?.errorMessage || baseAuthAction.errorMessage,\n        };\n      }\n    }\n\n    return baseAuthAction;\n  }\n\n  getUniqueActions(): string[] {\n    return [\n      ...new Set(this.authActions.map((authAction) => authAction.action)),\n    ];\n  }\n\n  getUniqueResources(): string[] {\n    return [\n      ...new Set(this.authActions.map((authAction) => authAction.resource)),\n    ];\n  }\n\n  getByResource(resource: string): AuthAction[] | undefined {\n    return this.authActions.filter(\n      (authAction) => authAction.resource === resource\n    );\n  }\n\n  getByAction(action: string): AuthAction[] {\n    return this.authActions.filter(\n      (authAction) => authAction.action === action\n    );\n  }\n\n  exists(action: string, resource: string): boolean {\n    return !!this.getOne(action, resource);\n  }\n}\n\nconst authActionService = new AuthActionService();\n\nexport default authActionService;\n"]}