arkos 2.0.0-next.3 → 2.0.0-next.30

package/dist/esm/modules/auth/utils/auth-prisma-json-schema-generator.js

@@ -0,0 +1,97 @@
+import { getArkosConfig } from "../../../utils/helpers/arkos-config.helpers.js";
+import { prismaSchemaParser, } from "../../../exports/prisma/index.js";
+import prismaJsonSchemaGenerator from "../../../utils/prisma/prisma-json-schema-generator.js";
+import { routeHookReader } from "../../../components/arkos-route-hook/reader.js";
+class AuthPrismaJsonSchemaGenerator {
+    userModel;
+    getUserModel() {
+        if (!this.userModel)
+            this.userModel = prismaSchemaParser.models.find((m) => m.name.toLowerCase() === "user");
+        return this.userModel;
+    }
+    getPrismaArgs(endpoint) {
+        return routeHookReader.getPrismaArgs("auth", endpoint) || {};
+    }
+    generateGetMeResponse() {
+        return prismaJsonSchemaGenerator.generateResponseSchema(this.getUserModel(), this.getPrismaArgs("getMe"));
+    }
+    generateUpdatePasswordSchema() {
+        return {
+            type: "object",
+            properties: {
+                currentPassword: { type: "string" },
+                newPassword: { type: "string", minLength: 8 },
+            },
+            required: ["currentPassword", "newPassword"],
+        };
+    }
+    generateUpdateMeSchema() {
+        const updateSchema = prismaJsonSchemaGenerator.generateUpdateSchema(this.getUserModel());
+        const restrictedFields = [
+            "roles",
+            "role",
+            "isActive",
+            "isStaff",
+            "isSuperUser",
+            "passwordChangedAt",
+            "deletedSelfAccountAt",
+            "password",
+            "lastLoginAt",
+        ];
+        restrictedFields.forEach((field) => {
+            delete updateSchema?.properties?.[field];
+        });
+        return updateSchema;
+    }
+    generateSignupSchema() {
+        const singupSchema = prismaJsonSchemaGenerator.generateCreateSchema(this.getUserModel());
+        const restrictedFields = [
+            "roles",
+            "role",
+            "isActive",
+            "isStaff",
+            "isSuperUser",
+            "passwordChangedAt",
+            "deletedSelfAccountAt",
+            "lastLoginAt",
+        ];
+        restrictedFields.forEach((field) => {
+            delete singupSchema?.properties?.[field];
+        });
+        return singupSchema;
+    }
+    generateLoginSchema() {
+        const allowedUsernames = getArkosConfig()?.authentication?.login
+            ?.allowedUsernames || ["username"];
+        const usernameProperties = {};
+        allowedUsernames.forEach((field) => {
+            const displayName = field.includes(".") ? field.split(".").pop() : field;
+            usernameProperties[displayName] = {
+                type: "string",
+                description: `Username field: ${field}`,
+            };
+        });
+        const baseSchema = {
+            type: "object",
+            properties: {
+                ...usernameProperties,
+                password: {
+                    type: "string",
+                    minLength: 8,
+                },
+            },
+            required: ["password"],
+        };
+        return {
+            ...baseSchema,
+            ...(allowedUsernames.length > 0 && {
+                anyOf: allowedUsernames.map((field) => ({
+                    required: [field.includes(".") ? field.split(".").pop() : field],
+                })),
+            }),
+        };
+    }
+}
+const authPrismaJsonSchemaGenerator = new AuthPrismaJsonSchemaGenerator();
+export default authPrismaJsonSchemaGenerator;
+//# sourceMappingURL=auth-prisma-json-schema-generator.js.map

package/dist/esm/modules/auth/utils/auth-prisma-json-schema-generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-prisma-json-schema-generator.js","sourceRoot":"","sources":["../../../../../src/modules/auth/utils/auth-prisma-json-schema-generator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,6CAA6C,CAAC;AAM7E,OAAO,EAEL,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,yBAAyB,MAAM,oDAAoD,CAAC;AAC3F,OAAO,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AAE9E,MAAM,6BAA6B;IACzB,SAAS,CAAe;IAExB,YAAY;QAClB,IAAI,CAAC,IAAI,CAAC,SAAS;YACjB,IAAI,CAAC,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAC7C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CACvC,CAAC;QAEJ,OAAO,IAAI,CAAC,SAAU,CAAC;IACzB,CAAC;IAEO,aAAa,CAAC,QAA2C;QAC/D,OAAO,eAAe,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/D,CAAC;IAED,qBAAqB;QACnB,OAAO,yBAAyB,CAAC,sBAAsB,CACrD,IAAI,CAAC,YAAY,EAAE,EACnB,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAC5B,CAAC;IACJ,CAAC;IAED,4BAA4B;QAC1B,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACnC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;aAC9C;YACD,QAAQ,EAAE,CAAC,iBAAiB,EAAE,aAAa,CAAC;SAC7C,CAAC;IACJ,CAAC;IAED,sBAAsB;QACpB,MAAM,YAAY,GAAG,yBAAyB,CAAC,oBAAoB,CACjE,IAAI,CAAC,YAAY,EAAE,CACpB,CAAC;QAGF,MAAM,gBAAgB,GAAG;YACvB,OAAO;YACP,MAAM;YACN,UAAU;YACV,SAAS;YACT,aAAa;YACb,mBAAmB;YACnB,sBAAsB;YACtB,UAAU;YACV,aAAa;SACd,CAAC;QACF,gBAAgB,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YACjC,OAAO,YAAY,EAAE,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,oBAAoB;QAClB,MAAM,YAAY,GAAG,yBAAyB,CAAC,oBAAoB,CACjE,IAAI,CAAC,YAAY,EAAE,CACpB,CAAC;QAEF,MAAM,gBAAgB,GAAG;YACvB,OAAO;YACP,MAAM;YACN,UAAU;YACV,SAAS;YACT,aAAa;YACb,mBAAmB;YACnB,sBAAsB;YACtB,aAAa;SACd,CAAC;QACF,gBAAgB,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YACjC,OAAO,YAAY,EAAE,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,mBAAmB;QACjB,MAAM,gBAAgB,GAAG,cAAc,EAAE,EAAE,cAAc,EAAE,KAAK;YAC9D,EAAE,gBAAgB,IAAI,CAAC,UAAU,CAAC,CAAC;QAErC,MAAM,kBAAkB,GAA2C,EAAE,CAAC;QAEtE,gBAAgB,CAAC,OAAO,CAAC,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YAC1E,kBAAkB,CAAC,WAAW,CAAC,GAAG;gBAChC,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,mBAAmB,KAAK,EAAE;aACxC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,UAAU,GAAuB;YACrC,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,GAAG,kBAAkB;gBACrB,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,CAAC;iBACb;aACF;YACD,QAAQ,EAAE,CAAC,UAAU,CAAC;SACvB,CAAC;QAEF,OAAO;YACL,GAAG,UAAU;YACb,GAAG,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI;gBACjC,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC;oBAC9C,QAAQ,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC,CAAC,CAAC,KAAK,CAAC;iBAClE,CAAC,CAAC;aACJ,CAAC;SACH,CAAC;IACJ,CAAC;CACF;AAED,MAAM,6BAA6B,GAAG,IAAI,6BAA6B,EAAE,CAAC;AAE1E,eAAe,6BAA6B,CAAC","sourcesContent":["import { OpenAPIV3 } from \"openapi-types\";\nimport { getArkosConfig } from \"../../../utils/helpers/arkos-config.helpers\";\nimport {\n  JsonSchema,\n  JsonSchemaProperty,\n  PrismaModel,\n} from \"../../../utils/prisma/types\";\nimport {\n  AuthPrismaQueryOptions,\n  prismaSchemaParser,\n} from \"../../../exports/prisma\";\nimport prismaJsonSchemaGenerator from \"../../../utils/prisma/prisma-json-schema-generator\";\nimport { routeHookReader } from \"../../../components/arkos-route-hook/reader\";\n\nclass AuthPrismaJsonSchemaGenerator {\n  private userModel?: PrismaModel;\n\n  private getUserModel() {\n    if (!this.userModel)\n      this.userModel = prismaSchemaParser.models.find(\n        (m) => m.name.toLowerCase() === \"user\"\n      );\n\n    return this.userModel!;\n  }\n\n  private getPrismaArgs(endpoint: keyof AuthPrismaQueryOptions<any>) {\n    return routeHookReader.getPrismaArgs(\"auth\", endpoint) || {};\n  }\n\n  generateGetMeResponse(): JsonSchema {\n    return prismaJsonSchemaGenerator.generateResponseSchema(\n      this.getUserModel(),\n      this.getPrismaArgs(\"getMe\")\n    );\n  }\n\n  generateUpdatePasswordSchema(): JsonSchema {\n    return {\n      type: \"object\",\n      properties: {\n        currentPassword: { type: \"string\" },\n        newPassword: { type: \"string\", minLength: 8 },\n      },\n      required: [\"currentPassword\", \"newPassword\"],\n    };\n  }\n\n  generateUpdateMeSchema(): JsonSchema {\n    const updateSchema = prismaJsonSchemaGenerator.generateUpdateSchema(\n      this.getUserModel()\n    );\n\n    // Remove sensitive fields that users shouldn't update themselves\n    const restrictedFields = [\n      \"roles\",\n      \"role\",\n      \"isActive\",\n      \"isStaff\",\n      \"isSuperUser\",\n      \"passwordChangedAt\",\n      \"deletedSelfAccountAt\",\n      \"password\",\n      \"lastLoginAt\",\n    ];\n    restrictedFields.forEach((field) => {\n      delete updateSchema?.properties?.[field];\n    });\n\n    return updateSchema;\n  }\n\n  generateSignupSchema(): JsonSchema {\n    const singupSchema = prismaJsonSchemaGenerator.generateCreateSchema(\n      this.getUserModel()\n    );\n\n    const restrictedFields = [\n      \"roles\",\n      \"role\",\n      \"isActive\",\n      \"isStaff\",\n      \"isSuperUser\",\n      \"passwordChangedAt\",\n      \"deletedSelfAccountAt\",\n      \"lastLoginAt\",\n    ];\n    restrictedFields.forEach((field) => {\n      delete singupSchema?.properties?.[field];\n    });\n\n    return singupSchema;\n  }\n\n  generateLoginSchema(): JsonSchema {\n    const allowedUsernames = getArkosConfig()?.authentication?.login\n      ?.allowedUsernames || [\"username\"];\n\n    const usernameProperties: Record<string, OpenAPIV3.SchemaObject> = {};\n\n    allowedUsernames.forEach((field: string) => {\n      const displayName = field.includes(\".\") ? field.split(\".\").pop()! : field;\n      usernameProperties[displayName] = {\n        type: \"string\",\n        description: `Username field: ${field}`,\n      };\n    });\n\n    const baseSchema: JsonSchemaProperty = {\n      type: \"object\",\n      properties: {\n        ...usernameProperties,\n        password: {\n          type: \"string\",\n          minLength: 8,\n        },\n      },\n      required: [\"password\"],\n    };\n\n    return {\n      ...baseSchema,\n      ...(allowedUsernames.length > 0 && {\n        anyOf: allowedUsernames.map((field: string) => ({\n          required: [field.includes(\".\") ? field.split(\".\").pop()! : field],\n        })),\n      }),\n    };\n  }\n}\n\nconst authPrismaJsonSchemaGenerator = new AuthPrismaJsonSchemaGenerator();\n\nexport default authPrismaJsonSchemaGenerator;\n"]}

package/dist/esm/modules/auth/utils/docs-links.js

@@ -0,0 +1,6 @@
+import { baseDocsLink } from "../../../utils/docs-links.js";
+const base = `${baseDocsLink}/core-concepts/authentication`;
+export const authenticationDocsLinks = {
+    setup: `${base}/setup`,
+};
+//# sourceMappingURL=docs-links.js.map

package/dist/esm/modules/auth/utils/docs-links.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docs-links.js","sourceRoot":"","sources":["../../../../../src/modules/auth/utils/docs-links.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,MAAM,IAAI,GAAG,GAAG,YAAY,+BAA+B,CAAC;AAE5D,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,KAAK,EAAE,GAAG,IAAI,QAAQ;CACvB,CAAC","sourcesContent":["import { baseDocsLink } from \"../../../utils/docs-links\";\n\nconst base = `${baseDocsLink}/core-concepts/authentication`;\n\nexport const authenticationDocsLinks = {\n  setup: `${base}/setup`,\n};\n"]}

package/dist/esm/modules/auth/utils/helpers/auth.controller.helpers.js

@@ -1,5 +1,6 @@
 import { getArkosConfig } from "../../../../server.js";
 import AppError from "../../../error-handler/utils/app-error.js";
+export const getDefaultUsernameField = () => getArkosConfig()?.authentication?.login?.allowedUsernames?.[0] || "username";
 export const determineUsernameField = (req) => {
     const authConfigs = getArkosConfig()?.authentication;
     if (req.query?.usernameField &&

package/dist/esm/modules/auth/utils/helpers/auth.controller.helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.controller.helpers.js","sourceRoot":"","sources":["../../../../../../src/modules/auth/utils/helpers/auth.controller.helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,QAAQ,MAAM,wCAAwC,CAAC;AAc9D,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAiB,EAAU,EAAE;IAClE,MAAM,WAAW,GAAG,cAAc,EAAE,EAAE,cAAc,CAAC;IAErD,IACE,GAAG,CAAC,KAAK,EAAE,aAAa;QACxB,OAAO,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,QAAQ;QAC5C,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC;QAEzE,OAAO,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC;SAC5B,IAAI,GAAG,CAAC,KAAK,EAAE,aAAa;QAC/B,MAAM,IAAI,QAAQ,CAChB,qDAAqD,EACrD,GAAG,CACJ,CAAC;IAEJ,OAAO,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC;AACjE,CAAC,CAAC;AAWF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,IAAY,EACZ,KAAU,EACW,EAAE;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAErB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,WAAW,GAAwB,EAAE,CAAC;IAG5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;QAC9B,OAAO,WAAW,CAAC;IACrB,CAAC;IAGD,IAAI,OAAO,GAAG,WAAW,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACnB,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;IAEzC,OAAO,WAAW,CAAC;AACrB,CAAC,CAAC;AAWF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAE,IAAY,EAAO,EAAE;IAC5D,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAEpC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAGvD,IAAI,YAAY,IAAI,GAAG,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAeF,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK;SACT,WAAW,EAAE;SACb,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC;SAC/B,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;SAC7B,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC;SAClC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC;SAC1B,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,KAA0B;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,GAAG,IAAI,CAAC;IAGnD,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAGxD,MAAM,KAAK,GAAG,oCAAoC,CAAC;IACnD,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAE3C,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAC;IAE7D,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAO1B,CAAC;IAER,MAAM,WAAW,GACf;QACE,EAAE,EAAE,CAAC;QACL,CAAC,EAAE,IAAI;QACP,CAAC,EAAE,KAAK;QACR,CAAC,EAAE,OAAO;QACV,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,SAAS;QACZ,CAAC,EAAE,WAAW;KACf,CAAC;IAEJ,OAAO,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC","sourcesContent":["import { getArkosConfig } from \"../../../../server\";\nimport { ArkosRequest } from \"../../../../types\";\nimport AppError from \"../../../error-handler/utils/app-error\";\n\n/**\n * Determines the username field to use for authentication and supports nested paths\n * Priority:\n * 1. req.query.usernameField\n * 2. config setting\n * 3. default \"username\"\n *\n * Supports dot notation for nested fields and array queries (e.g., \"profile.nickname\", \"phones.some.number\")\n *\n * @param req - The request object\n * @returns The field name to use for username identification\n */\nexport const determineUsernameField = (req: ArkosRequest): string => {\n  const authConfigs = getArkosConfig()?.authentication;\n\n  if (\n    req.query?.usernameField &&\n    typeof req.query?.usernameField === \"string\" &&\n    authConfigs?.login?.allowedUsernames?.includes?.(req.query.usernameField)\n  )\n    return req.query.usernameField;\n  else if (req.query?.usernameField)\n    throw new AppError(\n      \"Invalid usernameField parameter, it is not allowed!\",\n      400\n    );\n\n  return authConfigs?.login?.allowedUsernames?.[0] || \"username\";\n};\n\n/**\n * Creates a Prisma-compatible where clause from a path using dot notation\n * Handles nested objects and array queries with \"some\" operator\n * Example: createPrismaWhereClause(\"profile.nickname\", \"john\") or createPrismaWhereClause(\"phones.some.number\", \"1234567890\")\n *\n * @param path - The dot notation path (e.g., \"profile.nickname\" or \"phones.some.number\")\n * @param value - The value to search for\n * @returns A nested object suitable for Prisma's where clause\n */\nexport const createPrismaWhereClause = (\n  path: string,\n  value: any\n): Record<string, any> => {\n  if (!path) return {};\n\n  const parts = path.split(\".\");\n  const whereClause: Record<string, any> = {};\n\n  // Handle simple field case\n  if (parts.length === 1) {\n    whereClause[parts[0]] = value;\n    return whereClause;\n  }\n\n  // Handle nested fields\n  let current = whereClause;\n  for (let i = 0; i < parts.length - 1; i++) {\n    const part = parts[i];\n    current[part] = {};\n    current = current[part];\n  }\n\n  current[parts[parts.length - 1]] = value;\n\n  return whereClause;\n};\n\n/**\n * Access a value from a simple object based on a dot notation path\n * The object will only contain a single property that matches the last part of the path\n * Example: getNestedValue({nickname: \"john\"}, \"profile.nickname\") => \"john\"\n *\n * @param obj - The object containing the value (simple key-value pair)\n * @param path - The dot notation path (only the last part is used to access the object)\n * @returns The value from the object if the key matches the last part of the path, or undefined\n */\nexport const getNestedValue = (obj: any, path: string): any => {\n  if (!obj || !path) return undefined;\n\n  const properties = path.split(\".\");\n  const lastProperty = properties[properties.length - 1];\n\n  // If the last property exists in the object, return its value\n  if (lastProperty in obj) {\n    return obj[lastProperty];\n  }\n\n  return undefined;\n};\n\n/**\n * MsDuration type allows specific units for durations\n *\n * **For example**: 90d, 10ms, 50s.\n *\n * **Available metrics**: ms, s, m, h, d, w, y.\n * */\nexport type MsDuration =\n  | number\n  | `${number}`\n  | `${number}${\"ms\" | \"s\" | \"m\" | \"h\" | \"d\" | \"w\" | \"y\"}`; // Short format (e.g., \"1y\")\n\n// Normalize function to convert long units to short ones\nfunction normalizeDuration(input: string): string {\n  return input\n    .toLowerCase()\n    .replace(/years?|yr|year/g, \"y\")\n    .replace(/minutes?|min/g, \"m\")\n    .replace(/seconds?|sec|secs/g, \"s\")\n    .replace(/hours?|hr/g, \"h\")\n    .replace(/days?/g, \"d\")\n    .replace(/weeks?/g, \"w\")\n    .replace(/milliseconds?/g, \"ms\");\n}\n\nexport function toMs(input: number | MsDuration): number {\n  if (typeof input === \"number\") return input * 1000; // If it's a number, assume it's in seconds\n\n  // Normalize the string input\n  const normalizedInput = normalizeDuration(input.trim());\n\n  // Type assertion: we assert that normalizedInput will now match the MsDuration format\n  const regex = /^(\\d+(?:\\.\\d+)?)(ms|s|m|h|d|w|y)$/i;\n  const match = normalizedInput.match(regex);\n\n  if (!match) throw new Error(`Invalid time format: ${input}`);\n\n  const value = parseFloat(match[1]);\n  const unit = match[2].toLowerCase() as\n    | \"ms\"\n    | \"s\"\n    | \"m\"\n    | \"h\"\n    | \"d\"\n    | \"w\"\n    | \"y\";\n\n  const multipliers: Record<\"ms\" | \"s\" | \"m\" | \"h\" | \"d\" | \"w\" | \"y\", number> =\n    {\n      ms: 1,\n      s: 1000,\n      m: 60000,\n      h: 3600000,\n      d: 86400000,\n      w: 604800000,\n      y: 31557600000, // 365.25 days in ms\n    };\n\n  return value * multipliers[unit];\n}\n"]}
+{"version":3,"file":"auth.controller.helpers.js","sourceRoot":"","sources":["../../../../../../src/modules/auth/utils/helpers/auth.controller.helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,QAAQ,MAAM,wCAAwC,CAAC;AAE9D,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAW,EAAE,CAClD,cAAc,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC;AAc/E,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAiB,EAAU,EAAE;IAClE,MAAM,WAAW,GAAG,cAAc,EAAE,EAAE,cAAc,CAAC;IAErD,IACE,GAAG,CAAC,KAAK,EAAE,aAAa;QACxB,OAAO,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,QAAQ;QAC5C,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC;QAEzE,OAAO,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC;SAC5B,IAAI,GAAG,CAAC,KAAK,EAAE,aAAa;QAC/B,MAAM,IAAI,QAAQ,CAChB,qDAAqD,EACrD,GAAG,CACJ,CAAC;IAEJ,OAAO,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC;AACjE,CAAC,CAAC;AAWF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,IAAY,EACZ,KAAU,EACW,EAAE;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAErB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,WAAW,GAAwB,EAAE,CAAC;IAG5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;QAC9B,OAAO,WAAW,CAAC;IACrB,CAAC;IAGD,IAAI,OAAO,GAAG,WAAW,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACnB,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;IAEzC,OAAO,WAAW,CAAC;AACrB,CAAC,CAAC;AAWF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAE,IAAY,EAAO,EAAE;IAC5D,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAEpC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAGvD,IAAI,YAAY,IAAI,GAAG,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAeF,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK;SACT,WAAW,EAAE;SACb,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC;SAC/B,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;SAC7B,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC;SAClC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC;SAC1B,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,KAA0B;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,GAAG,IAAI,CAAC;IAGnD,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAGxD,MAAM,KAAK,GAAG,oCAAoC,CAAC;IACnD,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAE3C,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAC;IAE7D,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAO1B,CAAC;IAER,MAAM,WAAW,GACf;QACE,EAAE,EAAE,CAAC;QACL,CAAC,EAAE,IAAI;QACP,CAAC,EAAE,KAAK;QACR,CAAC,EAAE,OAAO;QACV,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,SAAS;QACZ,CAAC,EAAE,WAAW;KACf,CAAC;IAEJ,OAAO,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC","sourcesContent":["import { getArkosConfig } from \"../../../../server\";\nimport { ArkosRequest } from \"../../../../types\";\nimport AppError from \"../../../error-handler/utils/app-error\";\n\nexport const getDefaultUsernameField = (): string =>\n  getArkosConfig()?.authentication?.login?.allowedUsernames?.[0] || \"username\";\n\n/**\n * Determines the username field to use for authentication and supports nested paths\n * Priority:\n * 1. req.query.usernameField\n * 2. config setting\n * 3. default \"username\"\n *\n * Supports dot notation for nested fields and array queries (e.g., \"profile.nickname\", \"phones.some.number\")\n *\n * @param req - The request object\n * @returns The field name to use for username identification\n */\nexport const determineUsernameField = (req: ArkosRequest): string => {\n  const authConfigs = getArkosConfig()?.authentication;\n\n  if (\n    req.query?.usernameField &&\n    typeof req.query?.usernameField === \"string\" &&\n    authConfigs?.login?.allowedUsernames?.includes?.(req.query.usernameField)\n  )\n    return req.query.usernameField;\n  else if (req.query?.usernameField)\n    throw new AppError(\n      \"Invalid usernameField parameter, it is not allowed!\",\n      400\n    );\n\n  return authConfigs?.login?.allowedUsernames?.[0] || \"username\";\n};\n\n/**\n * Creates a Prisma-compatible where clause from a path using dot notation\n * Handles nested objects and array queries with \"some\" operator\n * Example: createPrismaWhereClause(\"profile.nickname\", \"john\") or createPrismaWhereClause(\"phones.some.number\", \"1234567890\")\n *\n * @param path - The dot notation path (e.g., \"profile.nickname\" or \"phones.some.number\")\n * @param value - The value to search for\n * @returns A nested object suitable for Prisma's where clause\n */\nexport const createPrismaWhereClause = (\n  path: string,\n  value: any\n): Record<string, any> => {\n  if (!path) return {};\n\n  const parts = path.split(\".\");\n  const whereClause: Record<string, any> = {};\n\n  // Handle simple field case\n  if (parts.length === 1) {\n    whereClause[parts[0]] = value;\n    return whereClause;\n  }\n\n  // Handle nested fields\n  let current = whereClause;\n  for (let i = 0; i < parts.length - 1; i++) {\n    const part = parts[i];\n    current[part] = {};\n    current = current[part];\n  }\n\n  current[parts[parts.length - 1]] = value;\n\n  return whereClause;\n};\n\n/**\n * Access a value from a simple object based on a dot notation path\n * The object will only contain a single property that matches the last part of the path\n * Example: getNestedValue({nickname: \"john\"}, \"profile.nickname\") => \"john\"\n *\n * @param obj - The object containing the value (simple key-value pair)\n * @param path - The dot notation path (only the last part is used to access the object)\n * @returns The value from the object if the key matches the last part of the path, or undefined\n */\nexport const getNestedValue = (obj: any, path: string): any => {\n  if (!obj || !path) return undefined;\n\n  const properties = path.split(\".\");\n  const lastProperty = properties[properties.length - 1];\n\n  // If the last property exists in the object, return its value\n  if (lastProperty in obj) {\n    return obj[lastProperty];\n  }\n\n  return undefined;\n};\n\n/**\n * MsDuration type allows specific units for durations\n *\n * **For example**: 90d, 10ms, 50s.\n *\n * **Available metrics**: ms, s, m, h, d, w, y.\n * */\nexport type MsDuration =\n  | number\n  | `${number}`\n  | `${number}${\"ms\" | \"s\" | \"m\" | \"h\" | \"d\" | \"w\" | \"y\"}`; // Short format (e.g., \"1y\")\n\n// Normalize function to convert long units to short ones\nfunction normalizeDuration(input: string): string {\n  return input\n    .toLowerCase()\n    .replace(/years?|yr|year/g, \"y\")\n    .replace(/minutes?|min/g, \"m\")\n    .replace(/seconds?|sec|secs/g, \"s\")\n    .replace(/hours?|hr/g, \"h\")\n    .replace(/days?/g, \"d\")\n    .replace(/weeks?/g, \"w\")\n    .replace(/milliseconds?/g, \"ms\");\n}\n\nexport function toMs(input: number | MsDuration): number {\n  if (typeof input === \"number\") return input * 1000; // If it's a number, assume it's in seconds\n\n  // Normalize the string input\n  const normalizedInput = normalizeDuration(input.trim());\n\n  // Type assertion: we assert that normalizedInput will now match the MsDuration format\n  const regex = /^(\\d+(?:\\.\\d+)?)(ms|s|m|h|d|w|y)$/i;\n  const match = normalizedInput.match(regex);\n\n  if (!match) throw new Error(`Invalid time format: ${input}`);\n\n  const value = parseFloat(match[1]);\n  const unit = match[2].toLowerCase() as\n    | \"ms\"\n    | \"s\"\n    | \"m\"\n    | \"h\"\n    | \"d\"\n    | \"w\"\n    | \"y\";\n\n  const multipliers: Record<\"ms\" | \"s\" | \"m\" | \"h\" | \"d\" | \"w\" | \"y\", number> =\n    {\n      ms: 1,\n      s: 1000,\n      m: 60000,\n      h: 3600000,\n      d: 86400000,\n      w: 604800000,\n      y: 31557600000, // 365.25 days in ms\n    };\n\n  return value * multipliers[unit];\n}\n"]}

package/dist/esm/modules/auth/utils/services/auth-action.service.js

@@ -1,19 +1,17 @@
-import { kebabCase } from "../../../../exports/utils/index.js";
+import { kebabCase, sentenceCase } from "../../../../exports/utils/index.js";
 import { getArkosConfig } from "../../../../utils/helpers/arkos-config.helpers.js";
 import { capitalize } from "../../../../utils/helpers/text.helpers.js";
 class AuthActionService {
-    constructor() {
-        this.authActions = [
-            {
-                roles: [],
-                action: "View",
-                resource: "auth-action",
-                name: "View auth action",
-                description: "View an auth action",
-                errorMessage: "You do not have permission to perform this operation",
-            },
-        ];
-    }
+    authActions = [
+        {
+            roles: [],
+            action: "View",
+            resource: "auth-action",
+            name: "View auth action",
+            description: "View an auth action",
+            errorMessage: "You cannot perform view for auth action",
+        },
+    ];
     add(action, resource, accessControl) {
         const transformedAction = this.transformAccessControlToValidAuthAction(action, resource, accessControl);
         const existingAuthAction = this.getOne(action, resource);
@@ -21,7 +19,7 @@ class AuthActionService {
             const inconsistencies = [];
             const defaultName = `${capitalize(kebabCase(action).replace(/-/g, " "))} ${capitalize(kebabCase(resource).replace(/-/g, " "))}`;
             const defaultDescription = `${capitalize(kebabCase(action).replace(/-/g, " "))} ${capitalize(kebabCase(resource).replace(/-/g, " "))}`;
-            const defaultErrorMessage = "You do not have permission to perform this operation";
+            const defaultErrorMessage = `You cannot perform ${sentenceCase(action).toLowerCase()} for ${sentenceCase(resource).toLowerCase()}`;
             const isNonDefault = (value, defaultValue) => {
                 return value !== undefined && value !== defaultValue;
             };
@@ -65,12 +63,14 @@ class AuthActionService {
             };
             this.remove(action, resource);
             this.authActions.push(merged);
+            return merged;
         }
         else {
             if (transformedAction.roles) {
                 transformedAction.roles = [...transformedAction.roles].sort();
             }
             this.authActions.push(transformedAction);
+            return transformedAction;
         }
     }
     remove(action, resource) {
@@ -98,7 +98,7 @@ class AuthActionService {
             resource,
             name: `${capitalize(kebabCase(action).replace(/-/g, " "))} ${capitalize(kebabCase(resource).replace(/-/g, " "))}`,
             description: `${capitalize(kebabCase(action).replace(/-/g, " "))} ${capitalize(kebabCase(resource).replace(/-/g, " "))}`,
-            errorMessage: `You do not have permission to perform this operation`,
+            errorMessage: `You cannot perform ${sentenceCase(action).toLowerCase()} for ${sentenceCase(resource).toLowerCase()}`,
         };
         const config = getArkosConfig();
         if (config?.authentication?.mode === "dynamic")
@@ -107,7 +107,11 @@ class AuthActionService {
             return baseAuthAction;
         if (Array.isArray(accessControl))
             return baseAuthAction;
-        const actionRule = accessControl !== "*" ? accessControl[action] : undefined;
+        const actionRule = accessControl !== "*"
+            ? accessControl[action]
+            : undefined;
+        if (config?.authentication?.mode !== "static")
+            delete baseAuthAction.roles;
         if (actionRule) {
             if (Array.isArray(actionRule)) {
                 return baseAuthAction;

package/dist/esm/modules/auth/utils/services/auth-action.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-action.service.js","sourceRoot":"","sources":["../../../../../../src/modules/auth/utils/services/auth-action.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAKtD,OAAO,EAAE,cAAc,EAAE,MAAM,gDAAgD,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAWpE,MAAM,iBAAiB;IAAvB;QACE,gBAAW,GAAiB;YAC1B;gBACE,KAAK,EAAE,EAAE;gBACT,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,aAAa;gBACvB,IAAI,EAAE,kBAAkB;gBACxB,WAAW,EAAE,qBAAqB;gBAClC,YAAY,EAAE,sDAAsD;aACrE;SACF,CAAC;IAgMJ,CAAC;IA9LC,GAAG,CAAC,MAAc,EAAE,QAAgB,EAAE,aAAmC;QACvE,MAAM,iBAAiB,GAAG,IAAI,CAAC,uCAAuC,CACpE,MAAM,EACN,QAAQ,EACR,aAAa,CACd,CAAC;QACF,MAAM,kBAAkB,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEzD,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,eAAe,GAAa,EAAE,CAAC;YAErC,MAAM,WAAW,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAChI,MAAM,kBAAkB,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YACvI,MAAM,mBAAmB,GACvB,sDAAsD,CAAC;YAEzD,MAAM,YAAY,GAAG,CACnB,KAAyB,EACzB,YAAoB,EACX,EAAE;gBACX,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,YAAY,CAAC;YACvD,CAAC,CAAC;YAEF,IACE,YAAY,CAAC,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC;gBAClD,YAAY,CAAC,iBAAiB,CAAC,IAAI,EAAE,WAAW,CAAC;gBACjD,kBAAkB,CAAC,IAAI,KAAK,iBAAiB,CAAC,IAAI,EAClD,CAAC;gBACD,eAAe,CAAC,IAAI,CAClB,cAAc,kBAAkB,CAAC,IAAI,SAAS,iBAAiB,CAAC,IAAI,GAAG,CACxE,CAAC;YACJ,CAAC;YAED,IACE,YAAY,CAAC,kBAAkB,CAAC,WAAW,EAAE,kBAAkB,CAAC;gBAChE,YAAY,CAAC,iBAAiB,CAAC,WAAW,EAAE,kBAAkB,CAAC;gBAC/D,kBAAkB,CAAC,WAAW,KAAK,iBAAiB,CAAC,WAAW,EAChE,CAAC;gBACD,eAAe,CAAC,IAAI,CAClB,qBAAqB,kBAAkB,CAAC,WAAW,SAAS,iBAAiB,CAAC,WAAW,GAAG,CAC7F,CAAC;YACJ,CAAC;YAED,IACE,YAAY,CAAC,kBAAkB,CAAC,YAAY,EAAE,mBAAmB,CAAC;gBAClE,YAAY,CAAC,iBAAiB,CAAC,YAAY,EAAE,mBAAmB,CAAC;gBACjE,kBAAkB,CAAC,YAAY,KAAK,iBAAiB,CAAC,YAAY,EAClE,CAAC;gBACD,eAAe,CAAC,IAAI,CAClB,sBAAsB,kBAAkB,CAAC,YAAY,SAAS,iBAAiB,CAAC,YAAY,GAAG,CAChG,CAAC;YACJ,CAAC;YACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CACb,yCAAyC,MAAM,IAAI,QAAQ,KAAK;oBAC9D,gFAAgF;oBAChF,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC1B,yCAAyC,MAAM,IAAI,QAAQ,6DAA6D,CAC3H,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GACf,kBAAkB,CAAC,KAAK,IAAI,iBAAiB,CAAC,KAAK;gBACjD,CAAC,CAAC;oBACE,GAAG,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE,CAAC;oBACnC,GAAG,CAAC,iBAAiB,CAAC,KAAK,IAAI,EAAE,CAAC;iBACnC;gBACH,CAAC,CAAC,SAAS,CAAC;YAEhB,MAAM,WAAW,GAAG,WAAW;gBAC7B,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE;gBAClC,CAAC,CAAC,SAAS,CAAC;YAEd,MAAM,MAAM,GAAe;gBACzB,MAAM,EAAE,kBAAkB,CAAC,MAAM;gBACjC,QAAQ,EAAE,kBAAkB,CAAC,QAAQ;gBACrC,KAAK,EAAE,WAAW;gBAClB,IAAI,EAAE,kBAAkB,CAAC,IAAI,IAAI,iBAAiB,CAAC,IAAI;gBACvD,WAAW,EACT,kBAAkB,CAAC,WAAW,IAAI,iBAAiB,CAAC,WAAW;gBACjE,YAAY,EACV,kBAAkB,CAAC,YAAY,IAAI,iBAAiB,CAAC,YAAY;aACpE,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC9B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,IAAI,iBAAiB,CAAC,KAAK,EAAE,CAAC;gBAC5B,iBAAiB,CAAC,KAAK,GAAG,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,QAAgB;QACrC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CACxC,CAAC,UAAU,EAAE,EAAE,CACb,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,CACtE,CAAC;IACJ,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,QAAgB;QACrC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAC1B,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,CACnE,CAAC;IACJ,CAAC;IAEO,uCAAuC,CAC7C,MAAc,EACd,QAAgB,EAChB,aAAmC;QAEnC,MAAM,cAAc,GAAe;YACjC,KAAK,EACH,CAAC,aAAa;gBACZ,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;oBAC3B,CAAC,CAAC,aAAa;oBACf,CAAC,CAAC,OAAO,aAAa,KAAK,QAAQ;wBACjC,CAAC,CAAC,CAAC,aAAa,CAAC;wBACjB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;4BAC5C,CAAC,CAAE,aAAa,CAAC,MAAM,CAAc;4BACrC,CAAC,CAAE,aAAa,CAAC,MAAM,CAA+B;gCAClD,EAAE,KAAK,CAAC,CAAC;gBACrB,EAAE;YACJ,MAAM;YACN,QAAQ;YACR,IAAI,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE;YACjH,WAAW,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE;YACxH,YAAY,EAAE,sDAAsD;SACrE,CAAC;QAEF,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAEhC,IAAI,MAAM,EAAE,cAAc,EAAE,IAAI,KAAK,SAAS;YAAE,OAAO,cAAc,CAAC,KAAK,CAAC;QAE5E,IAAI,CAAC,aAAa;YAAE,OAAO,cAAc,CAAC;QAE1C,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;YAAE,OAAO,cAAc,CAAC;QAExD,MAAM,UAAU,GACd,aAAa,KAAK,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE5D,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,OAAO,cAAc,CAAC;YACxB,CAAC;iBAAM,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;gBAC1C,OAAO;oBACL,GAAG,cAAc;oBACjB,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI;oBAC5C,WAAW,EAAE,UAAU,EAAE,WAAW,IAAI,cAAc,CAAC,WAAW;oBAClE,YAAY,EAAE,UAAU,EAAE,YAAY,IAAI,cAAc,CAAC,YAAY;iBACtE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,gBAAgB;QACd,OAAO;YACL,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACpE,CAAC;IACJ,CAAC;IAED,kBAAkB;QAChB,OAAO;YACL,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;SACtE,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,QAAgB;QAC5B,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAC5B,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ,CACjD,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,MAAc;QACxB,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAC5B,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,KAAK,MAAM,CAC7C,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,QAAgB;QACrC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;CACF;AAED,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,EAAE,CAAC;AAElD,eAAe,iBAAiB,CAAC","sourcesContent":["import { kebabCase } from \"../../../../exports/utils\";\nimport {\n  AccessControlConfig,\n  DetailedAccessControlRule,\n} from \"../../../../types/auth\";\nimport { getArkosConfig } from \"../../../../utils/helpers/arkos-config.helpers\";\nimport { capitalize } from \"../../../../utils/helpers/text.helpers\";\n\ninterface AuthAction {\n  roles?: string[] | \"*\";\n  action: string;\n  resource: string;\n  name?: string;\n  description?: string;\n  errorMessage?: string;\n}\n\nclass AuthActionService {\n  authActions: AuthAction[] = [\n    {\n      roles: [],\n      action: \"View\",\n      resource: \"auth-action\",\n      name: \"View auth action\",\n      description: \"View an auth action\",\n      errorMessage: \"You do not have permission to perform this operation\",\n    },\n  ];\n\n  add(action: string, resource: string, accessControl?: AccessControlConfig) {\n    const transformedAction = this.transformAccessControlToValidAuthAction(\n      action,\n      resource,\n      accessControl\n    );\n    const existingAuthAction = this.getOne(action, resource);\n\n    if (existingAuthAction) {\n      const inconsistencies: string[] = [];\n\n      const defaultName = `${capitalize(kebabCase(action).replace(/-/g, \" \"))} ${capitalize(kebabCase(resource).replace(/-/g, \" \"))}`;\n      const defaultDescription = `${capitalize(kebabCase(action).replace(/-/g, \" \"))} ${capitalize(kebabCase(resource).replace(/-/g, \" \"))}`;\n      const defaultErrorMessage =\n        \"You do not have permission to perform this operation\";\n\n      const isNonDefault = (\n        value: string | undefined,\n        defaultValue: string\n      ): boolean => {\n        return value !== undefined && value !== defaultValue;\n      };\n\n      if (\n        isNonDefault(existingAuthAction.name, defaultName) &&\n        isNonDefault(transformedAction.name, defaultName) &&\n        existingAuthAction.name !== transformedAction.name\n      ) {\n        inconsistencies.push(\n          `  - name: \"${existingAuthAction.name}\" vs \"${transformedAction.name}\"`\n        );\n      }\n\n      if (\n        isNonDefault(existingAuthAction.description, defaultDescription) &&\n        isNonDefault(transformedAction.description, defaultDescription) &&\n        existingAuthAction.description !== transformedAction.description\n      ) {\n        inconsistencies.push(\n          `  - description: \"${existingAuthAction.description}\" vs \"${transformedAction.description}\"`\n        );\n      }\n\n      if (\n        isNonDefault(existingAuthAction.errorMessage, defaultErrorMessage) &&\n        isNonDefault(transformedAction.errorMessage, defaultErrorMessage) &&\n        existingAuthAction.errorMessage !== transformedAction.errorMessage\n      ) {\n        inconsistencies.push(\n          `  - errorMessage: \"${existingAuthAction.errorMessage}\" vs \"${transformedAction.errorMessage}\"`\n        );\n      }\n      if (inconsistencies.length > 0) {\n        throw new Error(\n          `Inconsistent metadata for permission \"${action}:${resource}\". ` +\n            `The same action+resource combination is being defined with different values:\\n` +\n            inconsistencies.join(\"\\n\") +\n            `\\n\\nPlease ensure all definitions of \"${action}:${resource}\" have the same name, description, and errorMessage values.`\n        );\n      }\n\n      const mergedRoles =\n        existingAuthAction.roles || transformedAction.roles\n          ? [\n              ...(existingAuthAction.roles || []),\n              ...(transformedAction.roles || []),\n            ]\n          : undefined;\n\n      const uniqueRoles = mergedRoles\n        ? [...new Set(mergedRoles)].sort()\n        : undefined;\n\n      const merged: AuthAction = {\n        action: existingAuthAction.action,\n        resource: existingAuthAction.resource,\n        roles: uniqueRoles,\n        name: existingAuthAction.name ?? transformedAction.name,\n        description:\n          existingAuthAction.description ?? transformedAction.description,\n        errorMessage:\n          existingAuthAction.errorMessage ?? transformedAction.errorMessage,\n      };\n\n      this.remove(action, resource);\n      this.authActions.push(merged);\n    } else {\n      if (transformedAction.roles) {\n        transformedAction.roles = [...transformedAction.roles].sort();\n      }\n      this.authActions.push(transformedAction);\n    }\n  }\n\n  remove(action: string, resource: string) {\n    this.authActions = this.authActions.filter(\n      (authAction) =>\n        !(authAction.action === action && authAction.resource === resource)\n    );\n  }\n\n  getAll(): AuthAction[] {\n    return this.authActions;\n  }\n\n  getOne(action: string, resource: string): AuthAction | undefined {\n    return this.authActions.find(\n      (authAction) =>\n        authAction.action === action && authAction.resource === resource\n    );\n  }\n\n  private transformAccessControlToValidAuthAction(\n    action: string,\n    resource: string,\n    accessControl?: AccessControlConfig\n  ): AuthAction {\n    const baseAuthAction: AuthAction = {\n      roles:\n        (accessControl &&\n          (Array.isArray(accessControl)\n            ? accessControl\n            : typeof accessControl === \"string\"\n              ? [accessControl]\n              : Array.isArray(accessControl?.[action] || {})\n                ? (accessControl[action] as string[])\n                : (accessControl[action] as DetailedAccessControlRule)\n                    ?.roles)) ||\n        [],\n      action,\n      resource,\n      name: `${capitalize(kebabCase(action).replace(/-/g, \" \"))} ${capitalize(kebabCase(resource).replace(/-/g, \" \"))}`,\n      description: `${capitalize(kebabCase(action).replace(/-/g, \" \"))} ${capitalize(kebabCase(resource).replace(/-/g, \" \"))}`,\n      errorMessage: `You do not have permission to perform this operation`,\n    };\n\n    const config = getArkosConfig();\n\n    if (config?.authentication?.mode === \"dynamic\") delete baseAuthAction.roles;\n\n    if (!accessControl) return baseAuthAction;\n\n    if (Array.isArray(accessControl)) return baseAuthAction;\n\n    const actionRule =\n      accessControl !== \"*\" ? accessControl[action] : undefined;\n\n    if (actionRule) {\n      if (Array.isArray(actionRule)) {\n        return baseAuthAction;\n      } else if (typeof actionRule === \"object\") {\n        return {\n          ...baseAuthAction,\n          name: actionRule.name || baseAuthAction.name,\n          description: actionRule?.description || baseAuthAction.description,\n          errorMessage: actionRule?.errorMessage || baseAuthAction.errorMessage,\n        };\n      }\n    }\n\n    return baseAuthAction;\n  }\n\n  getUniqueActions(): string[] {\n    return [\n      ...new Set(this.authActions.map((authAction) => authAction.action)),\n    ];\n  }\n\n  getUniqueResources(): string[] {\n    return [\n      ...new Set(this.authActions.map((authAction) => authAction.resource)),\n    ];\n  }\n\n  getByResource(resource: string): AuthAction[] | undefined {\n    return this.authActions.filter(\n      (authAction) => authAction.resource === resource\n    );\n  }\n\n  getByAction(action: string): AuthAction[] {\n    return this.authActions.filter(\n      (authAction) => authAction.action === action\n    );\n  }\n\n  exists(action: string, resource: string): boolean {\n    return !!this.getOne(action, resource);\n  }\n}\n\nconst authActionService = new AuthActionService();\n\nexport default authActionService;\n"]}
+{"version":3,"file":"auth-action.service.js","sourceRoot":"","sources":["../../../../../../src/modules/auth/utils/services/auth-action.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAKpE,OAAO,EAAE,cAAc,EAAE,MAAM,gDAAgD,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAWpE,MAAM,iBAAiB;IACrB,WAAW,GAAiB;QAC1B;YACE,KAAK,EAAE,EAAE;YACT,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,aAAa;YACvB,IAAI,EAAE,kBAAkB;YACxB,WAAW,EAAE,qBAAqB;YAClC,YAAY,EAAE,yCAAyC;SACxD;KACF,CAAC;IAEF,GAAG,CACD,MAAc,EACd,QAAgB,EAChB,aAAmC;QAEnC,MAAM,iBAAiB,GAAG,IAAI,CAAC,uCAAuC,CACpE,MAAM,EACN,QAAQ,EACR,aAAa,CACd,CAAC;QACF,MAAM,kBAAkB,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEzD,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,eAAe,GAAa,EAAE,CAAC;YAErC,MAAM,WAAW,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAChI,MAAM,kBAAkB,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YACvI,MAAM,mBAAmB,GAAG,sBAAsB,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,QAAQ,YAAY,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YAEnI,MAAM,YAAY,GAAG,CACnB,KAAyB,EACzB,YAAoB,EACX,EAAE;gBACX,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,YAAY,CAAC;YACvD,CAAC,CAAC;YAEF,IACE,YAAY,CAAC,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC;gBAClD,YAAY,CAAC,iBAAiB,CAAC,IAAI,EAAE,WAAW,CAAC;gBACjD,kBAAkB,CAAC,IAAI,KAAK,iBAAiB,CAAC,IAAI,EAClD,CAAC;gBACD,eAAe,CAAC,IAAI,CAClB,cAAc,kBAAkB,CAAC,IAAI,SAAS,iBAAiB,CAAC,IAAI,GAAG,CACxE,CAAC;YACJ,CAAC;YAED,IACE,YAAY,CAAC,kBAAkB,CAAC,WAAW,EAAE,kBAAkB,CAAC;gBAChE,YAAY,CAAC,iBAAiB,CAAC,WAAW,EAAE,kBAAkB,CAAC;gBAC/D,kBAAkB,CAAC,WAAW,KAAK,iBAAiB,CAAC,WAAW,EAChE,CAAC;gBACD,eAAe,CAAC,IAAI,CAClB,qBAAqB,kBAAkB,CAAC,WAAW,SAAS,iBAAiB,CAAC,WAAW,GAAG,CAC7F,CAAC;YACJ,CAAC;YAED,IACE,YAAY,CAAC,kBAAkB,CAAC,YAAY,EAAE,mBAAmB,CAAC;gBAClE,YAAY,CAAC,iBAAiB,CAAC,YAAY,EAAE,mBAAmB,CAAC;gBACjE,kBAAkB,CAAC,YAAY,KAAK,iBAAiB,CAAC,YAAY,EAClE,CAAC;gBACD,eAAe,CAAC,IAAI,CAClB,sBAAsB,kBAAkB,CAAC,YAAY,SAAS,iBAAiB,CAAC,YAAY,GAAG,CAChG,CAAC;YACJ,CAAC;YACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CACb,yCAAyC,MAAM,IAAI,QAAQ,KAAK;oBAC9D,gFAAgF;oBAChF,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC1B,yCAAyC,MAAM,IAAI,QAAQ,6DAA6D,CAC3H,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GACf,kBAAkB,CAAC,KAAK,IAAI,iBAAiB,CAAC,KAAK;gBACjD,CAAC,CAAC;oBACE,GAAG,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE,CAAC;oBACnC,GAAG,CAAC,iBAAiB,CAAC,KAAK,IAAI,EAAE,CAAC;iBACnC;gBACH,CAAC,CAAC,SAAS,CAAC;YAEhB,MAAM,WAAW,GAAG,WAAW;gBAC7B,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE;gBAClC,CAAC,CAAC,SAAS,CAAC;YAEd,MAAM,MAAM,GAAyB;gBACnC,MAAM,EAAE,kBAAkB,CAAC,MAAM;gBACjC,QAAQ,EAAE,kBAAkB,CAAC,QAAQ;gBACrC,KAAK,EAAE,WAAW;gBAClB,IAAI,EAAE,kBAAkB,CAAC,IAAI,IAAI,iBAAiB,CAAC,IAAI;gBACvD,WAAW,EACT,kBAAkB,CAAC,WAAW,IAAI,iBAAiB,CAAC,WAAW;gBACjE,YAAY,EACV,kBAAkB,CAAC,YAAY,IAAI,iBAAiB,CAAC,YAAY;aAC7D,CAAC;YAET,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC9B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9B,OAAO,MAAM,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,IAAI,iBAAiB,CAAC,KAAK,EAAE,CAAC;gBAC5B,iBAAiB,CAAC,KAAK,GAAG,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACzC,OAAO,iBAAiB,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,QAAgB;QACrC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CACxC,CAAC,UAAU,EAAE,EAAE,CACb,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,CACtE,CAAC;IACJ,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,QAAgB;QACrC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAC1B,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,CACnE,CAAC;IACJ,CAAC;IAEO,uCAAuC,CAC7C,MAAc,EACd,QAAgB,EAChB,aAAmC;QAEnC,MAAM,cAAc,GAAyB;YAC3C,KAAK,EACH,CAAC,aAAa;gBACZ,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;oBAC3B,CAAC,CAAC,aAAa;oBACf,CAAC,CAAC,OAAO,aAAa,KAAK,QAAQ;wBACjC,CAAC,CAAC,CAAC,aAAa,CAAC;wBACjB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;4BAC5C,CAAC,CAAE,aAAa,CAAC,MAAM,CAAc;4BACrC,CAAC,CAAE,aAAa,CAAC,MAAM,CAA+B;gCAClD,EAAE,KAAK,CAAC,CAAC;gBACrB,EAAE;YACJ,MAAM;YACN,QAAQ;YACR,IAAI,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE;YACjH,WAAW,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE;YACxH,YAAY,EAAE,sBAAsB,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,QAAQ,YAAY,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE;SACrH,CAAC;QAEF,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAEhC,IAAI,MAAM,EAAE,cAAc,EAAE,IAAI,KAAK,SAAS;YAC5C,OAAQ,cAAsB,CAAC,KAAK,CAAC;QAEvC,IAAI,CAAC,aAAa;YAAE,OAAO,cAAc,CAAC;QAE1C,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;YAAE,OAAO,cAAc,CAAC;QAExD,MAAM,UAAU,GACb,aAAqB,KAAK,GAAG;YAC5B,CAAC,CAAE,aAAqB,CAAC,MAAM,CAAC;YAChC,CAAC,CAAC,SAAS,CAAC;QAEhB,IAAI,MAAM,EAAE,cAAc,EAAE,IAAI,KAAK,QAAQ;YAC3C,OAAQ,cAAsB,CAAC,KAAK,CAAC;QAEvC,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,OAAO,cAAc,CAAC;YACxB,CAAC;iBAAM,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;gBAC1C,OAAO;oBACL,GAAG,cAAc;oBACjB,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI;oBAC5C,WAAW,EAAE,UAAU,EAAE,WAAW,IAAI,cAAc,CAAC,WAAW;oBAClE,YAAY,EAAE,UAAU,EAAE,YAAY,IAAI,cAAc,CAAC,YAAY;iBACtE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,gBAAgB;QACd,OAAO;YACL,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACpE,CAAC;IACJ,CAAC;IAED,kBAAkB;QAChB,OAAO;YACL,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;SACtE,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,QAAgB;QAC5B,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAC5B,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ,CACjD,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,MAAc;QACxB,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAC5B,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,KAAK,MAAM,CAC7C,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,QAAgB;QACrC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;CACF;AAED,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,EAAE,CAAC;AAElD,eAAe,iBAAiB,CAAC","sourcesContent":["import { kebabCase, sentenceCase } from \"../../../../exports/utils\";\nimport {\n  AccessControlConfig,\n  DetailedAccessControlRule,\n} from \"../../../../types/auth\";\nimport { getArkosConfig } from \"../../../../utils/helpers/arkos-config.helpers\";\nimport { capitalize } from \"../../../../utils/helpers/text.helpers\";\n\nexport interface AuthAction {\n  roles?: string[] | \"*\";\n  action: string;\n  resource: string;\n  name?: string;\n  description?: string;\n  errorMessage?: string;\n}\n\nclass AuthActionService {\n  authActions: AuthAction[] = [\n    {\n      roles: [],\n      action: \"View\",\n      resource: \"auth-action\",\n      name: \"View auth action\",\n      description: \"View an auth action\",\n      errorMessage: \"You cannot perform view for auth action\",\n    },\n  ];\n\n  add(\n    action: string,\n    resource: string,\n    accessControl?: AccessControlConfig\n  ): Required<AuthAction> {\n    const transformedAction = this.transformAccessControlToValidAuthAction(\n      action,\n      resource,\n      accessControl\n    );\n    const existingAuthAction = this.getOne(action, resource);\n\n    if (existingAuthAction) {\n      const inconsistencies: string[] = [];\n\n      const defaultName = `${capitalize(kebabCase(action).replace(/-/g, \" \"))} ${capitalize(kebabCase(resource).replace(/-/g, \" \"))}`;\n      const defaultDescription = `${capitalize(kebabCase(action).replace(/-/g, \" \"))} ${capitalize(kebabCase(resource).replace(/-/g, \" \"))}`;\n      const defaultErrorMessage = `You cannot perform ${sentenceCase(action).toLowerCase()} for ${sentenceCase(resource).toLowerCase()}`;\n\n      const isNonDefault = (\n        value: string | undefined,\n        defaultValue: string\n      ): boolean => {\n        return value !== undefined && value !== defaultValue;\n      };\n\n      if (\n        isNonDefault(existingAuthAction.name, defaultName) &&\n        isNonDefault(transformedAction.name, defaultName) &&\n        existingAuthAction.name !== transformedAction.name\n      ) {\n        inconsistencies.push(\n          `  - name: \"${existingAuthAction.name}\" vs \"${transformedAction.name}\"`\n        );\n      }\n\n      if (\n        isNonDefault(existingAuthAction.description, defaultDescription) &&\n        isNonDefault(transformedAction.description, defaultDescription) &&\n        existingAuthAction.description !== transformedAction.description\n      ) {\n        inconsistencies.push(\n          `  - description: \"${existingAuthAction.description}\" vs \"${transformedAction.description}\"`\n        );\n      }\n\n      if (\n        isNonDefault(existingAuthAction.errorMessage, defaultErrorMessage) &&\n        isNonDefault(transformedAction.errorMessage, defaultErrorMessage) &&\n        existingAuthAction.errorMessage !== transformedAction.errorMessage\n      ) {\n        inconsistencies.push(\n          `  - errorMessage: \"${existingAuthAction.errorMessage}\" vs \"${transformedAction.errorMessage}\"`\n        );\n      }\n      if (inconsistencies.length > 0) {\n        throw new Error(\n          `Inconsistent metadata for permission \"${action}:${resource}\". ` +\n            `The same action+resource combination is being defined with different values:\\n` +\n            inconsistencies.join(\"\\n\") +\n            `\\n\\nPlease ensure all definitions of \"${action}:${resource}\" have the same name, description, and errorMessage values.`\n        );\n      }\n\n      const mergedRoles =\n        existingAuthAction.roles || transformedAction.roles\n          ? [\n              ...(existingAuthAction.roles || []),\n              ...(transformedAction.roles || []),\n            ]\n          : undefined;\n\n      const uniqueRoles = mergedRoles\n        ? [...new Set(mergedRoles)].sort()\n        : undefined;\n\n      const merged: Required<AuthAction> = {\n        action: existingAuthAction.action,\n        resource: existingAuthAction.resource,\n        roles: uniqueRoles,\n        name: existingAuthAction.name ?? transformedAction.name,\n        description:\n          existingAuthAction.description ?? transformedAction.description,\n        errorMessage:\n          existingAuthAction.errorMessage ?? transformedAction.errorMessage,\n      } as any;\n\n      this.remove(action, resource);\n      this.authActions.push(merged);\n      return merged;\n    } else {\n      if (transformedAction.roles) {\n        transformedAction.roles = [...transformedAction.roles].sort();\n      }\n      this.authActions.push(transformedAction);\n      return transformedAction;\n    }\n  }\n\n  remove(action: string, resource: string) {\n    this.authActions = this.authActions.filter(\n      (authAction) =>\n        !(authAction.action === action && authAction.resource === resource)\n    );\n  }\n\n  getAll(): AuthAction[] {\n    return this.authActions;\n  }\n\n  getOne(action: string, resource: string): AuthAction | undefined {\n    return this.authActions.find(\n      (authAction) =>\n        authAction.action === action && authAction.resource === resource\n    );\n  }\n\n  private transformAccessControlToValidAuthAction(\n    action: string,\n    resource: string,\n    accessControl?: AccessControlConfig\n  ): Required<AuthAction> {\n    const baseAuthAction: Required<AuthAction> = {\n      roles:\n        (accessControl &&\n          (Array.isArray(accessControl)\n            ? accessControl\n            : typeof accessControl === \"string\"\n              ? [accessControl]\n              : Array.isArray(accessControl?.[action] || {})\n                ? (accessControl[action] as string[])\n                : (accessControl[action] as DetailedAccessControlRule)\n                    ?.roles)) ||\n        [],\n      action,\n      resource,\n      name: `${capitalize(kebabCase(action).replace(/-/g, \" \"))} ${capitalize(kebabCase(resource).replace(/-/g, \" \"))}`,\n      description: `${capitalize(kebabCase(action).replace(/-/g, \" \"))} ${capitalize(kebabCase(resource).replace(/-/g, \" \"))}`,\n      errorMessage: `You cannot perform ${sentenceCase(action).toLowerCase()} for ${sentenceCase(resource).toLowerCase()}`,\n    };\n\n    const config = getArkosConfig();\n\n    if (config?.authentication?.mode === \"dynamic\")\n      delete (baseAuthAction as any).roles;\n\n    if (!accessControl) return baseAuthAction;\n\n    if (Array.isArray(accessControl)) return baseAuthAction;\n\n    const actionRule =\n      (accessControl as any) !== \"*\"\n        ? (accessControl as any)[action]\n        : undefined;\n\n    if (config?.authentication?.mode !== \"static\")\n      delete (baseAuthAction as any).roles;\n\n    if (actionRule) {\n      if (Array.isArray(actionRule)) {\n        return baseAuthAction;\n      } else if (typeof actionRule === \"object\") {\n        return {\n          ...baseAuthAction,\n          name: actionRule.name || baseAuthAction.name,\n          description: actionRule?.description || baseAuthAction.description,\n          errorMessage: actionRule?.errorMessage || baseAuthAction.errorMessage,\n        };\n      }\n    }\n\n    return baseAuthAction;\n  }\n\n  getUniqueActions(): string[] {\n    return [\n      ...new Set(this.authActions.map((authAction) => authAction.action)),\n    ];\n  }\n\n  getUniqueResources(): string[] {\n    return [\n      ...new Set(this.authActions.map((authAction) => authAction.resource)),\n    ];\n  }\n\n  getByResource(resource: string): AuthAction[] | undefined {\n    return this.authActions.filter(\n      (authAction) => authAction.resource === resource\n    );\n  }\n\n  getByAction(action: string): AuthAction[] {\n    return this.authActions.filter(\n      (authAction) => authAction.action === action\n    );\n  }\n\n  exists(action: string, resource: string): boolean {\n    return !!this.getOne(action, resource);\n  }\n}\n\nconst authActionService = new AuthActionService();\n\nexport default authActionService;\n"]}

package/dist/esm/modules/auth/utils/token-extraction.js

@@ -0,0 +1,57 @@
+export const ACCESS_TOKEN_COOKIE_NAME = "arkos_access_token";
+export const NO_TOKEN_SENTINEL = "no-token";
+export function normalizeToken(value) {
+    if (typeof value !== "string")
+        return null;
+    const token = value.trim();
+    return token || null;
+}
+export function getCookieToken(cookies, cookieName = ACCESS_TOKEN_COOKIE_NAME) {
+    if (!cookies)
+        return null;
+    const token = normalizeToken(cookies[cookieName]);
+    return token === NO_TOKEN_SENTINEL ? null : token;
+}
+export function parseCookieHeader(cookieHeader) {
+    const cookies = {};
+    if (!cookieHeader || typeof cookieHeader !== "string")
+        return cookies;
+    for (const pair of cookieHeader.split(";")) {
+        const separator = pair.indexOf("=");
+        if (separator < 1)
+            continue;
+        const key = pair.slice(0, separator).trim();
+        if (!key)
+            continue;
+        let value;
+        try {
+            value = decodeURIComponent(pair.slice(separator + 1).trim());
+        }
+        catch {
+            continue;
+        }
+        cookies[key] = value;
+    }
+    return cookies;
+}
+export function extractBearerToken(authorization, { caseInsensitive = true } = {}) {
+    if (!authorization || typeof authorization !== "string")
+        return null;
+    if (!caseInsensitive) {
+        if (!authorization.startsWith("Bearer"))
+            return null;
+        return normalizeToken(authorization.split(" ")[1]);
+    }
+    const match = /^Bearer\s*(.*)$/i.exec(authorization.trim());
+    return match ? normalizeToken(match[1]) : null;
+}
+export function resolveRequestToken({ authorization, cookies, cookieName = ACCESS_TOKEN_COOKIE_NAME, }) {
+    return (extractBearerToken(authorization, { caseInsensitive: false }) ??
+        getCookieToken(cookies, cookieName));
+}
+export function resolveSocketToken({ auth, key = "token", headers, cookies, cookieHeader, cookieName = ACCESS_TOKEN_COOKIE_NAME, }) {
+    return (normalizeToken(auth?.[key]) ??
+        extractBearerToken(headers?.authorization) ??
+        getCookieToken(cookies ?? parseCookieHeader(cookieHeader ?? headers?.cookie), cookieName));
+}
+//# sourceMappingURL=token-extraction.js.map

package/dist/esm/modules/auth/utils/token-extraction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-extraction.js","sourceRoot":"","sources":["../../../../../src/modules/auth/utils/token-extraction.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AAC7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAK5C,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,OAAO,KAAK,IAAI,IAAI,CAAC;AACvB,CAAC;AAMD,MAAM,UAAU,cAAc,CAC5B,OAA4C,EAC5C,aAAqB,wBAAwB;IAE7C,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAClD,OAAO,KAAK,KAAK,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AACpD,CAAC;AAMD,MAAM,UAAU,iBAAiB,CAC/B,YAA4B;IAE5B,MAAM,OAAO,GAAc,EAAE,CAAC;IAE9B,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAEtE,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,GAAG,CAAC;YAAE,SAAS;QAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,GAAG;YAAE,SAAS;QAEnB,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACvB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AASD,MAAM,UAAU,kBAAkB,CAChC,aAA6B,EAC7B,EAAE,eAAe,GAAG,IAAI,KAAoC,EAAE;IAE9D,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAErE,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,OAAO,cAAc,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAYD,MAAM,UAAU,mBAAmB,CAAC,EAClC,aAAa,EACb,OAAO,EACP,UAAU,GAAG,wBAAwB,GACjB;IACpB,OAAO,CACL,kBAAkB,CAAC,aAAa,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QAC7D,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CACpC,CAAC;AACJ,CAAC;AAoBD,MAAM,UAAU,kBAAkB,CAAC,EACjC,IAAI,EACJ,GAAG,GAAG,OAAO,EACb,OAAO,EACP,OAAO,EACP,YAAY,EACZ,UAAU,GAAG,wBAAwB,GAClB;IACnB,OAAO,CACL,cAAc,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;QAC3B,kBAAkB,CAAC,OAAO,EAAE,aAAa,CAAC;QAC1C,cAAc,CACZ,OAAO,IAAI,iBAAiB,CAAC,YAAY,IAAI,OAAO,EAAE,MAAM,CAAC,EAC7D,UAAU,CACX,CACF,CAAC;AACJ,CAAC","sourcesContent":["export const ACCESS_TOKEN_COOKIE_NAME = \"arkos_access_token\";\nexport const NO_TOKEN_SENTINEL = \"no-token\";\n\nexport type CookieMap = Record<string, string>;\n\n/** Returns the trimmed token if it is non-empty, otherwise `null`. */\nexport function normalizeToken(value: unknown): string | null {\n  if (typeof value !== \"string\") return null;\n\n  const token = value.trim();\n  return token || null;\n}\n\n/**\n * Reads a token from an already-parsed cookie map (e.g. Express's `req.cookies`).\n * Arkos writes the `no-token` sentinel on logout, so it counts as absent.\n */\nexport function getCookieToken(\n  cookies: Record<string, unknown> | undefined,\n  cookieName: string = ACCESS_TOKEN_COOKIE_NAME,\n): string | null {\n  if (!cookies) return null;\n\n  const token = normalizeToken(cookies[cookieName]);\n  return token === NO_TOKEN_SENTINEL ? null : token;\n}\n\n/**\n * Parses a raw `Cookie` header without requiring cookie-parser.\n * Values may contain `=`; malformed pairs are skipped.\n */\nexport function parseCookieHeader(\n  cookieHeader?: string | null,\n): CookieMap {\n  const cookies: CookieMap = {};\n\n  if (!cookieHeader || typeof cookieHeader !== \"string\") return cookies;\n\n  for (const pair of cookieHeader.split(\";\")) {\n    const separator = pair.indexOf(\"=\");\n    if (separator < 1) continue;\n\n    const key = pair.slice(0, separator).trim();\n    if (!key) continue;\n\n    let value: string;\n    try {\n      value = decodeURIComponent(pair.slice(separator + 1).trim());\n    } catch {\n      continue;\n    }\n\n    cookies[key] = value;\n  }\n\n  return cookies;\n}\n\n/**\n * Extracts a bearer token from an `Authorization` header.\n *\n * The default mode is case-insensitive and tolerates a missing space after\n * `Bearer`. Pass `{ caseInsensitive: false }` to preserve the legacy HTTP\n * behavior exactly.\n */\nexport function extractBearerToken(\n  authorization?: string | null,\n  { caseInsensitive = true }: { caseInsensitive?: boolean } = {},\n): string | null {\n  if (!authorization || typeof authorization !== \"string\") return null;\n\n  if (!caseInsensitive) {\n    if (!authorization.startsWith(\"Bearer\")) return null;\n    return normalizeToken(authorization.split(\" \")[1]);\n  }\n\n  const match = /^Bearer\\s*(.*)$/i.exec(authorization.trim());\n  return match ? normalizeToken(match[1]) : null;\n}\n\nexport interface RequestTokenSources {\n  authorization?: string;\n  cookies?: Record<string, unknown>;\n  cookieName?: string;\n}\n\n/**\n * Resolves the token for an HTTP request-like object.\n * Precedence: `Authorization` header, then the access-token cookie.\n */\nexport function resolveRequestToken({\n  authorization,\n  cookies,\n  cookieName = ACCESS_TOKEN_COOKIE_NAME,\n}: RequestTokenSources): string | null {\n  return (\n    extractBearerToken(authorization, { caseInsensitive: false }) ??\n    getCookieToken(cookies, cookieName)\n  );\n}\n\nexport interface SocketTokenSources {\n  auth?: Record<string, unknown>;\n  key?: string;\n  headers?: {\n    authorization?: string;\n    cookie?: string;\n  };\n  /** Pre-parsed cookies, when available. */\n  cookies?: CookieMap;\n  /** Raw `Cookie` header, used when `cookies` is not provided. */\n  cookieHeader?: string;\n  cookieName?: string;\n}\n\n/**\n * Resolves the token for a Socket.IO connection.\n * Precedence: `handshake.auth.token`, `Authorization` header, access-token cookie.\n */\nexport function resolveSocketToken({\n  auth,\n  key = \"token\",\n  headers,\n  cookies,\n  cookieHeader,\n  cookieName = ACCESS_TOKEN_COOKIE_NAME,\n}: SocketTokenSources): string | null {\n  return (\n    normalizeToken(auth?.[key]) ??\n    extractBearerToken(headers?.authorization) ??\n    getCookieToken(\n      cookies ?? parseCookieHeader(cookieHeader ?? headers?.cookie),\n      cookieName,\n    )\n  );\n}\n"]}